Description
A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/emp_del.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-08-29
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from the emp_del.php script in itsourcecode's Sales and Inventory System, where the ID argument is concatenated into a SQL query without proper sanitization. This allows an unauthenticated remote attacker to inject arbitrary SQL statements, leading to unauthorized data disclosure, modification, or deletion within the database. The impact level is moderate, with a CVSS score of 5.3 indicating potential for significant data compromise.

Affected Systems

The affected product is itsourcecode Sales and Inventory System, version 1.0. Only the emp_del.php page is documented to be vulnerable, but the exact affected functions are not specified beyond the ID parameter manipulation.

Risk and Exploitability

The exploit is publicly disclosed and can be launched remotely. With a CVSS score of 5.3 and no EPSS data, the likelihood of exploitation appears moderate, and the vulnerability is not listed in the CISA KEV catalog. Attackers would typically send a crafted ID value to the application's HTTP endpoint, causing the backend to execute injected SQL.

Generated by OpenCVE AI on August 29, 2026 at 23:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Validate and sanitize all input parameters to prevent malicious SQL code
  • Refactor the code to use parameterized queries or prepared statements instead of building SQL strings
  • Limit the database account used by the application to the minimum privileges necessary and monitor for abnormal activity

Generated by OpenCVE AI on August 29, 2026 at 23:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 29 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/emp_del.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Title itsourcecode Sales and Inventory System emp_del.php sql injection
First Time appeared Itsourcecode
Itsourcecode sales And Inventory System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:sales_and_inventory_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode sales And Inventory System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Sales And Inventory System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-29T21:45:09.789Z

Reserved: 2026-08-29T05:33:08.320Z

Link: CVE-2026-82422

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-29T22:16:32.017

Modified: 2026-08-29T22:16:32.017

Link: CVE-2026-82422

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-29T23:30:17Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')