Executive brief
itsourcecode Sales and Inventory System is a PHP-based web application used for managing sales and inventory operations. A SQL injection vulnerability in the supplier deletion page allows authenticated attackers to manipulate database queries, potentially leading to unauthorized data access, modification, or deletion of business-critical inventory and sales records.
Technical details
This is a SQL injection vulnerability in the /pages/sup_del.php file, specifically in the 'id' parameter used with the supplier type query. The application fails to sanitize or validate user input before incorporating it into SQL queries, allowing attackers to inject malicious SQL code. The vulnerability requires authentication (valid PHPSESSID cookie shown in PoC), but is remotely exploitable via HTTP GET requests. Attackers can extract sensitive data, modify database contents, or potentially achieve command execution depending on database permissions. The recommended fix is to use prepared statements with parameter binding and implement strict input validation.
Affected products
- itsourcecode Sales and Inventory System 1.0
Timeline
- 2026-07-21: disclosed
- 2026-09-06: advisory