Executive brief
itsourcecode Sales and Inventory System is a PHP-based inventory management application used for tracking sales and stock. A SQL injection vulnerability in the product deletion function allows authenticated attackers to manipulate database queries, potentially leading to unauthorized data access, modification, or system compromise.
Technical details
A SQL injection vulnerability exists in the /pages/inv_del.php file's 'id' parameter, where user input is not properly sanitized before being included in SQL queries. The vulnerability requires valid authentication credentials (the attacker must be logged in) and is exploitable via the network through HTTP GET requests. An attacker can inject malicious SQL code through the 'id' parameter to bypass query logic, extract sensitive data, modify database records, or potentially achieve remote code execution depending on database permissions. The suggested remediation includes using prepared statements with parameterized queries, implementing strict input validation, restricting database user permissions, and conducting regular security audits.
Affected products
- itsourcecode Sales and Inventory System 1.0
Timeline
- 2026-07-18: disclosed: Vulnerability disclosed on GitHub
- 2026-09-04: advisory: CVE-2026-85383 published