Executive brief
itsourcecode Sales and Inventory System is a free PHP/MySQL application used by businesses to manage inventory, employee records, and transactions. A SQL injection vulnerability in the employee transaction module allows authenticated attackers to inject malicious database commands through the firstname field, potentially leading to unauthorized database access, data theft, or manipulation of business records.
Technical details
A SQL injection vulnerability exists in /pages/emp_transac.php where the 'firstname' parameter is not properly sanitized before being used in SQL queries. The vulnerability is triggered via POST request with action=add and requires valid authentication (PHPSESSID cookie). An authenticated attacker can inject SQL code (e.g., time-based blind SQL injection using SLEEP() functions) to manipulate queries, extract sensitive data, modify records, or potentially achieve remote code execution. The vendor recommends using prepared statements/parameterized queries, input validation, and restricting database user permissions. No patch has been confirmed available as of the advisory date.
Affected products
- itsourcecode Sales and Inventory System 1.0
Timeline
- 2026-08-02: disclosed
- 2026-09-13: advisory