Executive brief
itsourcecode Sales and Inventory System is a PHP-based point-of-sale and inventory management application used by small businesses. A SQL injection vulnerability in the transaction processing module allows authenticated attackers to manipulate database queries, potentially exposing sensitive business data, modifying sales records, or disrupting operations.
Technical details
A SQL injection vulnerability exists in the /pages/pos_transac.php file, specifically in the 'customer' parameter when action=add. The application fails to sanitize user input before incorporating it into SQL queries. Exploitation requires valid authentication credentials and network access to the application. An attacker can inject arbitrary SQL through the 'customer' parameter to bypass queries, extract sensitive data, modify records, or potentially execute administrative commands. The vulnerability is correctable through prepared statements, parameterized queries, and strict input validation.
Affected products
- itsourcecode Sales and Inventory System 1.0
Timeline
- 2026-07-21: disclosed
- 2026-09-07: advisory