Executive brief
itsourcecode Sales and Inventory System is a free PHP-based inventory and sales management application. A SQL injection vulnerability in the employee deletion page allows authenticated attackers to inject malicious SQL code via the ID parameter, potentially exposing sensitive database information, modifying or deleting critical business data, and compromising the entire system.
Technical details
A SQL injection vulnerability exists in the /pages/emp_del.php file of itsourcecode Sales and Inventory System 1.0, specifically in the 'id' parameter. The application fails to properly sanitize or validate user input before incorporating it into SQL queries. Authentication is required (attacker must be logged in with valid credentials), but the attack is remotely exploitable. An attacker can inject malicious SQL queries to access the database, exfiltrate sensitive data, modify records, delete data, or potentially achieve system compromise. The vulnerability can be remediated by using prepared statements with parameter binding, implementing strict input validation and filtering, and enforcing least-privilege database permissions.
Affected products
- itsourcecode Sales and Inventory System 1.0
Timeline
- 2026-07-13: disclosed
- 2026-08-29: advisory