CVE-2026-78656

itsourcecode Sales and Inventory System cust_del.php sql injection

View on CVE.org
Published Aug 25, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_del.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.

Analysis

AI-generated

Technical impact

The vulnerability lies in the cust_del.php page of the itsourcecode Sales and Inventory System, where the ID argument is not properly sanitized. This allows an attacker to inject SQL code into the database query, enabling unauthorized data access or manipulation. The flaw is a classic injection weakness (CWE-74, CWE-89).

Affected Systems

Affects the itsourcecode Sales and Inventory System version 1.0. No further version granularity is provided. The flaw resides in the cust_del.php script and is triggered by external ID parameters.

Risk and Exploitability

The flaw can be exploited remotely by manipulating crafted requests to the ID parameter. The CVSS base score of 5.3 indicates moderate severity. EPSS is not available and KEV is not listed, but the public release of an exploit demonstrates that the vulnerability is actionable and poses a tangible threat to unpatched systems.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply vendor‑supplied patch or confirmed update that addresses the SQL injection in cust_del.php
  • Restrict public access to the /pages/cust_del.php endpoint, allowing only authenticated, privileged users to reach it
  • Implement input validation for the ID parameter and use prepared statements for all database queries
  • Deploy web‑application firewall rules that block suspicious SQL injection patterns in request parameters

Generated by OpenCVE AI on August 25, 2026 at 07:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_del.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
Title itsourcecode Sales and Inventory System cust_del.php sql injection
First Time appeared Itsourcecode
Itsourcecode sales And Inventory System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:sales_and_inventory_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode sales And Inventory System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Aug 25, 2026, 11:55 AM
Reserved
Aug 24, 2026, 11:12 PM

View source JSON

Updated
Aug 25, 2026, 11:55 AM

JSON

Status
Deferred
Published
Aug 25, 2026, 7:17 AM
Modified
Aug 26, 2026, 4:19 PM

View source JSON

No data.

Updated
Aug 25, 2026, 8:00 AM

JSON