Executive brief
itsourcecode Sales and Inventory System is a free PHP-based inventory and sales management application used by small businesses and students. A SQL injection vulnerability in the settings editor allows authenticated attackers to manipulate database queries through the 'id' parameter, potentially leading to unauthorized data access, modification, or deletion of critical business records.
Technical details
The vulnerability is a SQL injection flaw in /pages/settings_edit.php where the 'id' parameter is not properly sanitized before being used in SQL queries. An authenticated attacker can inject malicious SQL code through the 'id' POST parameter to manipulate database queries and extract, modify, or delete data. The attack requires valid credentials (session cookie present in PoC), but is network-accessible via HTTP POST. Attackers can bypass intended logic, dump sensitive data, or gain comprehensive control over the database. The recommended fix is to use prepared statements with parameter binding, input validation, and principle of least privilege for database accounts.
Affected products
- itsourcecode Sales and Inventory System 1.0
Timeline
- 2026-07-25: disclosed: Vulnerability disclosed on GitHub issue #10
- 2026-09-07: advisory: CVE-2026-86270 published