Executive brief
itsourcecode Sales and Inventory System is a free PHP-based inventory and sales management application. A SQL injection vulnerability in the inventory edit function allows authenticated attackers to inject malicious SQL commands through the ID parameter, potentially leading to unauthorized database access, data theft, modification, or complete system compromise.
Technical details
A SQL injection vulnerability exists in /pages/inv_edit.php due to improper input validation and sanitization of the 'id' parameter. The vulnerability requires valid authentication credentials (post-login access) but is remotely exploitable over the network. An attacker can inject malicious SQL code via the id query parameter to manipulate SQL queries, enabling unauthorized database access, data extraction, data manipulation, or potential remote code execution. The fix requires implementing prepared statements, parameterized queries, strict input validation to enforce numeric format, and application of the principle of least privilege to database user accounts.
Affected products
- itsourcecode Sales and Inventory System 1.0
Timeline
- 2026-07-16: disclosed
- 2026-08-31: advisory