Executive brief
The Sales and Inventory System is a free PHP-based application used by small businesses to manage product sales and inventory. A SQL injection vulnerability in the product editing page allows attackers with valid login credentials to manipulate database queries through the product ID parameter, potentially exposing sensitive business data, corrupting records, or taking complete control of the underlying database.
Technical details
The vulnerability is a SQL injection flaw in the /pages/pro_edit.php file, where the 'id' GET parameter is not properly sanitized or parameterized before use in SQL queries. An authenticated attacker can inject malicious SQL code through the 'id' parameter to execute arbitrary queries against the database. The attack requires valid user credentials and network access to the application. Successful exploitation allows unauthorized data access, data modification, data deletion, and potential code execution depending on database permissions. The vendor recommends implementing prepared statements with parameter binding, strict input validation, and minimizing database user permissions as mitigations.
Affected products
- itsourcecode Sales and Inventory System 1.0
Timeline
- 2026-07-14: disclosed: Vulnerability disclosed on GitHub issue #21
- 2026-08-30: advisory: CVE-2026-82485 published to NVD