Executive brief
itsourcecode Sales and Inventory System is a free open-source PHP application used to manage sales and inventory operations. A SQL injection vulnerability in the /pages/sup_transac.php file allows remote attackers to manipulate the companyname parameter and execute arbitrary SQL queries against the backend database, potentially exposing or modifying sensitive transaction and inventory data.
Technical details
This is a classic SQL injection vulnerability in the sup_transac.php file where user-supplied input from the companyname parameter is not properly sanitized before being incorporated into SQL queries. The vulnerability is remotely exploitable without authentication and can be triggered via direct HTTP requests. An attacker can inject malicious SQL code to extract sensitive data, modify records, or potentially execute system commands depending on database permissions. The exploit has been publicly disclosed; affected installations running version 1.0 should apply vendor patches or implement input validation and parameterized queries immediately.
Affected products
- itsourcecode Sales and Inventory System 1.0
Timeline
- 2026-09-07: disclosed
- other: Exploit now public