A flaw was discovered in itsourcecode Sales-and-Inventory-System that allows an attacker to inject arbitrary SQL through manipulation of the ID argument in the /pages/cust_edit.php file. The injection can be triggered remotely, enabling an attacker to read, modify, or delete database records, potentially exposing sensitive customer or inventory information. The vulnerability is categorized as CWE-74 (Unvalidated Input) and CWE-89 (SQL Injection).

The affected product is itsourcecode Sales-and-Inventory-System. All versions up to commit 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac are potentially vulnerable; no fixed release information is available because the project currently employs rolling continuous delivery and has not yet published a patch. The vulnerability impacts all deployments where the cust_edit.php endpoint is exposed.

The CVSS score is 5.3, indicating a moderate level of severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote and can be initiated by sending a specially crafted HTTP request with a malicious ID value to the cust_edit.php page. Exploitation has been publicly documented and could be used to compromise the database if no mitigations are applied.