Executive brief
itsourcecode Sales and Inventory System is a PHP/MySQL application used for managing sales and inventory operations. A SQL injection vulnerability in the customer transaction module allows authenticated attackers to inject malicious SQL code through the firstname parameter, potentially leading to unauthorized database access, data theft, data modification, or complete system compromise.
Technical details
A SQL injection vulnerability exists in /pages/cust_pos_trans.php where user-supplied input from the 'firstname' parameter is not properly sanitized or parameterized before being used in SQL queries. The vulnerability is accessible to authenticated users and can be exploited by injecting SQL code (e.g., time-based blind SQL injection using SLEEP() functions). An attacker with valid credentials can manipulate SQL queries to extract sensitive data, modify database records, bypass access controls, or potentially execute arbitrary commands at the database level. The vulnerability is confirmed exploitable via proof-of-concept; remediation requires implementing prepared statements, input validation, and strict database user permissions.
Affected products
- itsourcecode Sales and Inventory System 1.0
Timeline
- 2026-08-01: disclosed: Vulnerability disclosed on GitHub
- 2026-09-13: advisory: CVE-2026-90525 published