Description
A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_del.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
Published: 2026-08-25
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability lies in the cust_del.php page of the itsourcecode Sales and Inventory System, where the ID argument is not properly sanitized. This allows an attacker to inject SQL code into the database query, enabling unauthorized data access or manipulation. The flaw is a classic injection weakness (CWE-74, CWE-89).

Affected Systems

Affects the itsourcecode Sales and Inventory System version 1.0. No further version granularity is provided. The flaw resides in the cust_del.php script and is triggered by external ID parameters.

Risk and Exploitability

The flaw can be exploited remotely by manipulating crafted requests to the ID parameter. The CVSS base score of 5.3 indicates moderate severity. EPSS is not available and KEV is not listed, but the public release of an exploit demonstrates that the vulnerability is actionable and poses a tangible threat to unpatched systems.

Generated by OpenCVE AI on August 25, 2026 at 07:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply vendor‑supplied patch or confirmed update that addresses the SQL injection in cust_del.php
  • Restrict public access to the /pages/cust_del.php endpoint, allowing only authenticated, privileged users to reach it
  • Implement input validation for the ID parameter and use prepared statements for all database queries
  • Deploy web‑application firewall rules that block suspicious SQL injection patterns in request parameters

Generated by OpenCVE AI on August 25, 2026 at 07:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 06:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_del.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
Title itsourcecode Sales and Inventory System cust_del.php sql injection
First Time appeared Itsourcecode
Itsourcecode sales And Inventory System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:sales_and_inventory_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode sales And Inventory System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Sales And Inventory System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-25T06:15:09.674Z

Reserved: 2026-08-24T23:12:54.911Z

Link: CVE-2026-78656

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-25T07:17:10.990

Modified: 2026-08-25T07:17:10.990

Link: CVE-2026-78656

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T08:00:13Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')