Executive brief
The itsourcecode Sales and Inventory System is a free web-based inventory and employee management application used by small businesses and students. A SQL injection vulnerability in the employee editing interface allows authenticated attackers to manipulate database queries, potentially exposing or altering customer data, employee records, and inventory information, or gaining full control of the underlying database.
Technical details
A SQL injection vulnerability exists in /pages/emp_edit.php where the 'id' parameter is not properly sanitized before use in SQL queries. The vulnerability requires valid authentication credentials but allows remote attackers to inject arbitrary SQL code through the 'id' parameter, enabling unauthorized database access, data exfiltration, data modification, or potential remote code execution depending on database permissions. The root cause is insufficient input validation and lack of prepared statement usage. No patch status is documented in the advisory.
Affected products
- itsourcecode Sales and Inventory System 1.0
Timeline
- 2026-07-13: disclosed
- 2026-08-29: advisory