Executive brief
itsourcecode Sales and Inventory System is a PHP-based application used for managing sales and inventory operations in small businesses and educational institutions. A SQL injection vulnerability in the user deletion functionality allows authenticated attackers to manipulate database queries, potentially leading to unauthorized data access, modification, or deletion, and could compromise the entire application's data integrity and availability.
Technical details
A SQL injection vulnerability exists in the "/pages/us_del.php" file of itsourcecode Sales and Inventory System 1.0, specifically in the 'id' parameter used for user deletion. The application fails to properly sanitize or validate user input before incorporating it into SQL queries. An authenticated attacker can inject malicious SQL code through the 'id' parameter (e.g., GET /pages/us_del.php?type=user&id=1 AND GTID_SUBSET(...)) to execute arbitrary database operations. The vulnerability requires valid user authentication (PHPSESSID cookie present in the proof-of-concept) and network access to the application. Exploitation allows attackers to extract sensitive data, modify database records, or potentially gain comprehensive control over the database. The recommended fix is to implement prepared statements with parameter binding, strict input validation, and principle-of-least-privilege database account permissions.
Affected products
- itsourcecode Sales and Inventory System 1.0
Timeline
- 2026-07-21: disclosed: Vulnerability disclosed on GitHub issue
- 2026-09-07: advisory: CVE-2026-86233 published