Executive brief
The itsourcecode Sales and Inventory System is a PHP-based application for managing sales and inventory operations. A SQL injection vulnerability in the supplier search function allows authenticated attackers to manipulate database queries through an unsanitized parameter, potentially leading to unauthorized data access, modification, or system compromise.
Technical details
A SQL injection vulnerability exists in /pages/sup_searchfrm.php where the 'id' parameter is improperly sanitized before use in SQL queries. The vulnerability is accessible to authenticated users (session cookie required) and allows attackers to inject arbitrary SQL code through the GET parameter. By crafting malicious SQL payloads, an attacker can bypass query logic, extract sensitive data from the database, modify or delete records, or potentially execute operating system commands depending on database permissions. The root cause is insufficient input validation and lack of prepared statements. Mitigation requires implementing parameterized queries, strict input validation, and enforcing least-privilege database permissions.
Affected products
- itsourcecode Sales and Inventory System 1.0
Timeline
- 2026-07-15: disclosed: Vulnerability disclosed on GitHub
- 2026-08-30: advisory: CVE-2026-82545 published