Executive brief
itsourcecode Sales and Inventory System is a PHP-based business management application for tracking customer transactions and sales. A SQL injection vulnerability in the customer transaction page allows authenticated attackers to inject malicious database commands through the firstname parameter, potentially exposing sensitive business data, tampering with transaction records, or gaining unauthorized system control.
Technical details
A SQL injection vulnerability exists in the /pages/cust_transac.php file of Sales and Inventory System v1.0, specifically in the 'firstname' parameter of the cust_transac.php?action=add endpoint. The application fails to properly sanitize or parameterize user input before incorporating it into SQL queries. An authenticated attacker can inject malicious SQL code via POST requests to manipulate database queries, as demonstrated in public proof-of-concept payloads using time-based blind SQL injection (SLEEP function). The attack requires valid authentication credentials but no special privileges. Exploitation enables unauthorized data access, data modification, and potentially full database compromise. Remediation involves implementing prepared statements with parameter binding and strict input validation.
Affected products
- itsourcecode Sales and Inventory System 1.0
Timeline
- 2026-07-21: disclosed
- 2026-09-07: advisory