Executive brief
itsourcecode Sales and Inventory System is a free PHP-based accounting and inventory management application commonly used by small businesses. A SQL injection vulnerability in the customer editing function allows authenticated attackers to manipulate database queries, potentially leading to unauthorized data access, modification, or complete database compromise and service disruption.
Technical details
A SQL injection vulnerability exists in the "/pages/cust_edit1.php" file of itsourcecode Sales and Inventory System v1.0, where the "id" parameter is not properly sanitized before use in SQL queries. An authenticated attacker can inject malicious SQL code through the id parameter (e.g., via POST request) to manipulate SQL query logic. The vulnerability requires valid login credentials but is otherwise remotely exploitable over the network. Successful exploitation allows attackers to extract sensitive database content, modify or delete records, bypass authorization controls, and potentially achieve full database server compromise. The recommended fix is to implement prepared statements with parameter binding and enforce strict input validation on all user-supplied parameters.
Affected products
- itsourcecode Sales and Inventory System 1.0
Timeline
- 2026-07-23: disclosed: Vulnerability disclosed on GitHub issue ltranquility/submit_repository#7
- 2026-09-07: advisory: CVE-2026-86310 published in NVD