# CVE-2026-114251: itsourcecode Sales and Inventory System SQL injection in cust_del.php

Source: https://junglewise.ai/threats/cve-2026-114251-a-vulnerability-has-been-found-in-itsourcecode-sales-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114251 · Severity: medium · CVSS 6.3 · Published 2026-10-21

Sales and Inventory System is a PHP-based application for managing customer and inventory data. A SQL injection vulnerability in the customer deletion page allows attackers to bypass authentication, extract sensitive data from the database, modify or delete records, and potentially gain full system control through malicious SQL queries injected via the ID parameter.

Vendors: [Itsourcecode](https://junglewise.ai/threats/vendors/itsourcecode).

## Quick answers

**Is CVE-2026-114251 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114251 being exploited in the wild.

**How severe is CVE-2026-114251?** Medium severity, with a CVSS score of 6.3, published 21 October 2026.

**Which products and versions are affected?** Itsourcecode Sales and Inventory System V1.0 and prior (up to commit 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac).

**Is there a fix for CVE-2026-114251?** No fixed version is recorded yet. Use prepared statements and parameterized queries to separate SQL code from user input. Implement strict input validation to ensure the 'id' parameter matches an expected numeric pattern. Minimize database user account permissions to the minimum necessary for application operation.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-07"},{"kind":"advisory","at":"2026-10-21"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-114251 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-114251?** Check whether you run Itsourcecode Sales and Inventory System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Use prepared statements and parameterized queries to separate SQL code from user input. Implement strict input validation to ensure the 'id' parameter matches an expected numeric pattern. Minimize database user account permissions to the minimum necessary for application operation.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-07"},{"kind":"advisory","at":"2026-10-21"}]

## Technical details

SQL injection flaw in /pages/cust_del.php where the 'id' parameter is not properly sanitized before being used in SQL queries. An authenticated attacker can inject arbitrary SQL code through the id parameter (via GET request) to execute unauthorized database operations. While the advisory states "no authentication required" in one section, the POC shows an active PHPSESSID cookie, indicating authenticated access is necessary; the vulnerability allows full database compromise including data exfiltration, modification, and deletion.

## Affected products

- itsourcecode Sales and Inventory System V1.0 and prior (up to commit 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac)

## References

- [https://github.com/DefaultFuction/Sales-and-Inventory-System/issues/2](https://github.com/DefaultFuction/Sales-and-Inventory-System/issues/2)
- [https://itsourcecode.com/](https://itsourcecode.com/)