Executive brief
itsourcecode Sales and Inventory System is a free PHP-based accounting and inventory management application used by small businesses. A SQL injection vulnerability in the customer search functionality allows authenticated attackers to manipulate database queries, potentially exposing sensitive customer data, altering records, or compromising the entire system.
Technical details
A SQL injection vulnerability exists in the /pages/cust_searchfrm.php file where the 'id' parameter is not properly sanitized before being used in SQL queries. An authenticated attacker can inject malicious SQL code through the id parameter (e.g., via a UNION-based attack) to extract arbitrary data from the database. The vulnerability is accessible over the network to any user with valid credentials. Successful exploitation allows attackers to read sensitive data, modify or delete records, or execute arbitrary SQL commands with database-level privileges. The recommended fix is to implement prepared statements with parameterized queries and enforce strict input validation.
Affected products
- itsourcecode Sales and Inventory System 1.0
Timeline
- 2026-07-14: disclosed
- 2026-08-30: advisory