Executive brief
itsourcecode Sales and Inventory System is a PHP-based application used for managing customer orders and inventory. A SQL injection vulnerability in the customer deletion function allows authenticated attackers to manipulate database queries, potentially exposing sensitive customer data, modifying records, or compromising system integrity.
Technical details
A SQL injection vulnerability exists in the /pages/cust_del.php file where the 'id' parameter is not properly sanitized before being used in SQL queries. The vulnerability is accessible to authenticated users (requires valid login credentials and active session). An attacker can craft malicious SQL payloads in the 'id' parameter to execute arbitrary SQL commands, leading to unauthorized database access, data leakage, or data manipulation. The vulnerability affects version 1.0 and remediation requires implementing prepared statements with parameter binding and strict input validation.
Affected products
- itsourcecode Sales and Inventory System 1.0
Timeline
- 2026-07-11: disclosed
- 2026-08-25: advisory