Executive brief
itsourcecode Sales and Inventory System is a PHP-based application used for managing sales and inventory data. The application contains a SQL injection vulnerability in a search function that allows authenticated users to inject malicious SQL code, potentially exposing sensitive employee and user information from the database.
Technical details
The vulnerability is a SQL injection in the file /pages/us_searchfrm.php, caused by unsafe concatenation of the $_GET['id'] parameter directly into a SQL query without sanitization or parameterized statements. The vulnerable code constructs a multi-table join query and inserts untrusted user input directly into the WHERE clause. Exploitation requires authentication (the attacker must be logged in), but no further user interaction is needed. An authenticated attacker can inject arbitrary SQL to retrieve unauthorized records containing sensitive data (employee names, emails, phone numbers, passwords, job titles, hired dates, location information) or manipulate query results depending on database permissions. The fix requires implementing prepared statements with bound parameters and strict input validation.
Affected products
- itsourcecode Sales and Inventory System 1.0
Timeline
- 2026-07-29: disclosed
- 2026-09-08: advisory