A vulnerability was discovered in itsourcecode Sales-and-Inventory-System that allows attackers to inject arbitrary SQL commands through manipulation of the ID argument in /pages/cust_searchfrm.php. This flaw makes the application vulnerable to remote SQL injection (CWE-89). The publicly available exploit could enable an attacker to read, modify, or delete sensitive data stored in the system’s database, compromising confidentiality and integrity of the application’s data.

The affected product is itsourcecode Sales-and-Inventory-System across all versions leading up to the code revision 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. Because the application follows a rolling‑release model, specific version numbers for affected or fixed releases are not documented, so any instance of the Sales‑and‑Inventory‑System running the identified code base is potentially vulnerable.

The CVSS score is 5.3, indicating a medium severity level. EPSS data is not available, so the likelihood of exploitation in the wild is unclear, however the public disclosure of the exploit raises concern. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. Remote attackers can trigger the injection by sending crafted HTTP requests to cust_searchfrm.php, and because the flaw involves unsanitized ID input, bypassing is straightforward once the request is constructed.