Executive brief
itsourcecode Sales and Inventory System is a PHP/MySQL application used to manage product sales and inventory. A SQL injection vulnerability in the product deletion function allows authenticated attackers to inject malicious SQL code, potentially exposing sensitive data, modifying records, or gaining unauthorized control over the database and entire application.
Technical details
A SQL injection vulnerability exists in the /pages/pro_del.php file of Sales and Inventory System v1.0, where the 'id' parameter is not properly sanitized before being used in SQL queries. The vulnerable code processes user input from the 'id' query parameter and concatenates it directly into SQL statements without using prepared statements or input validation. While the vulnerability requires valid authentication (the attacker must be logged in, as indicated by the PHPSESSID cookie in the proof-of-concept), any authenticated user can exploit this to read arbitrary database data, modify or delete records, and potentially execute operating system commands depending on database permissions. The fix involves implementing prepared statements with parameter binding, strict input validation to ensure the ID matches an expected numeric format, and applying principle of least privilege to database accounts.
Affected products
- itsourcecode Sales and Inventory System 1.0
Timeline
- 2026-07-19: disclosed: Vulnerability reported on GitHub issue #3
- 2026-09-06: advisory: CVE-2026-86163 published on NVD