Executive brief
itsourcecode Sales and Inventory System is a free PHP/MySQL-based inventory management application used by small businesses and students to track sales and stock. A SQL injection vulnerability in the search function allows authenticated attackers to manipulate database queries, potentially leading to unauthorized data access, modification, or complete system compromise. The vulnerability requires valid login credentials but poses a serious risk to stored inventory and sales data.
Technical details
This is a SQL injection vulnerability in the "id" parameter of /pages/inv_searchfrm.php in itsourcecode Sales and Inventory System version 1.0. The application fails to sanitize or use parameterized queries for the "id" input before incorporating it into SQL statements. An authenticated attacker can inject arbitrary SQL code through the id parameter (e.g., via GET request) to extract sensitive data, modify database records, or execute database commands. The attack requires valid session credentials (PHPSESSID) but is otherwise remotely exploitable. Remediation requires implementing prepared statements with parameter binding, input validation, and least-privilege database account permissions.
Affected products
- itsourcecode Sales and Inventory System 1.0
Timeline
- 2026-07-17: disclosed
- 2026-08-31: advisory