This vulnerability exists in the update_record function of includes/manage.php in the Rizwan17 inventory-management-system up to commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. By manipulating the arguments update_category, cid, update_brand, or update_product, an attacker can perform SQL injection remotely without authentication or user interaction. The rolling release model prevents precise version identification. The vulnerability was responsibly disclosed but remains unpatched and publicly exploitable.

Successful exploitation allows remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability does not require privileges or user interaction, increasing its risk. However, no active exploitation in the wild has been reported to date.

No official fix or patch is currently available from the vendor. Users should monitor the project for updates and consider implementing application-layer protections such as input validation or web application firewalls to mitigate SQL injection risks until an official remediation is released.