Executive brief
itsourcecode Sales and Inventory System is a PHP-based inventory management application. A SQL injection vulnerability in the /pages/sup_edit1.php file allows remote attackers to manipulate the ID parameter and execute arbitrary SQL queries, potentially exposing or modifying sensitive business data such as inventory records, supplier information, and transaction history.
Technical details
This is a SQL injection vulnerability in an unknown function within the /pages/sup_edit1.php file of itsourcecode Sales and Inventory System 1.0. The vulnerability exists in the ID parameter, which is not properly sanitized or parameterized before being used in SQL queries. The attack vector is network-based with no authentication required, allowing remote unauthenticated attackers to inject malicious SQL commands. An attacker can exploit this to read, modify, or delete database records. The vulnerability has been publicly disclosed and proof-of-concept exploits are available.
Affected products
- itsourcecode Sales and Inventory System 1.0
Timeline
- 2026-09-13: disclosed
- other: Exploit publicly available