CVE-2018-18804

CRITICAL

Bakeshop Inventory System 1.0 - SQL Injection via Login Screen

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-18804. PoCs published by Ihsan Sencan.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in Bakeshop Inventory System 1.0, allowing authentication bypass via crafted input in the login form. The vulnerable code concatenates user input directly into a SQL query without sanitization.

Description

Bakeshop Inventory System 1.0 has SQL injection via the login screen, related to include/publicfunction.vb.

Exploits (1)

exploitdb WORKING POC

by Ihsan Sencan · textwebappsphp

https://www.exploit-db.com/exploits/45720

View Code ZIP pw:eip

This exploit demonstrates a SQL injection vulnerability in Bakeshop Inventory System 1.0, allowing authentication bypass via crafted input in the login form. The vulnerable code concatenates user input directly into a SQL query without sanitization.

Classification

Working Poc 100%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: Bakeshop Inventory System 1.0

No auth needed

Prerequisites: access to the login page of the application

MITRE ATT&CK

T1189 - Drive-by Compromise T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Core References

Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/45720/

Exploit, Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/150012/Bakeshop-Inventory-System-In-VB.Net-MS-Access-Database-1.0-SQL-Injection.html

Scores

CVSS v3 9.8

EPSS 0.0321

EPSS Percentile 86.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-89

Status published

Products (1)

bakeshop_inventory_system_project/bakeshop_inventory_system 1.0

Published Nov 16, 2018

Tracked Since Feb 18, 2026