Description
A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/cust_edit.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.
Published: 2026-08-24
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A remote attacker can manipulate the ID argument in /pages/cust_edit.php, triggering an SQL injection through an unknown function. The vulnerability permits the execution of arbitrary SQL statements and can enable the attacker to read, modify, or delete database contents.

Affected Systems

The issue affects itsourcecode Sales and Inventory System version 1.0; no specific patch information is publicly available.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity while the EPSS score is not available, and it is not listed in the CISA KEV catalog. Because the exploit is public and the attack vector is remote, the risk is non‑negligible and should be mitigated promptly.

Generated by OpenCVE AI on August 24, 2026 at 05:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑provided fix or upgrade to the latest version of the Sales and Inventory System if one is available.
  • Modify the cust_edit.php script to validate and escape the ID parameter, or use parameterized queries to prevent injection.
  • Limit access to the cust_edit.php page by requiring authentication and restricting IP addresses or network segments.
  • Monitor database logs for abnormal activity and set alerts for suspicious query patterns.

Generated by OpenCVE AI on August 24, 2026 at 05:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 04:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/cust_edit.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.
Title itsourcecode Sales and Inventory System cust_edit.php sql injection
First Time appeared Itsourcecode
Itsourcecode sales And Inventory System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:sales_and_inventory_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode sales And Inventory System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Sales And Inventory System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-24T04:00:08.931Z

Reserved: 2026-08-23T16:38:47.556Z

Link: CVE-2026-78185

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-24T04:16:59.297

Modified: 2026-08-24T04:16:59.297

Link: CVE-2026-78185

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T05:30:12Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')