Description
A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/sup_edit.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-08-30
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is in itsourcecode Sales and Inventory System 1.0, specifically within the /pages/sup_edit.php file. The attacker can send a crafted ID argument that bypasses the intended controls, enabling the execution of arbitrary SQL statements. This results in a classic SQL injection that can expose, alter, or delete database contents.

Affected Systems

The vulnerability affects the Sales and Inventory System product from itsourcecode, version 1.0. Any user or process that can reach the sup_edit.php endpoint can potentially trigger the flaw; the flaw is remotely exploitable on the web interface.

Risk and Exploitability

The CVSS base score of 5.3 indicates moderate severity. The EPSS is not available, and the vulnerability is not listed in CISA KEV, which means no large‑scale exploitation has been confirmed. However, the publicly released exploit allows attackers to carry out the injection from a remote host, giving them the ability to read or modify sensitive inventory data, and possibly escalating privileges if the database user has higher rights.

Generated by OpenCVE AI on August 30, 2026 at 13:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest security patch or upgrade to a newer version of itsourcecode Sales and Inventory System that addresses the SQL injection vulnerability.
  • Restrict access to /pages/sup_edit.php to authenticated and authorized users only, enforcing strict input validation that requires the ID to be an integer.
  • If a patch is not immediately available, implement a temporary workaround by using prepared statements or sanitizing the ID parameter to remove dangerous characters before execution.

Generated by OpenCVE AI on August 30, 2026 at 13:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 30 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/sup_edit.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Title itsourcecode Sales and Inventory System sup_edit.php sql injection
First Time appeared Itsourcecode
Itsourcecode sales And Inventory System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:sales_and_inventory_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode sales And Inventory System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Sales And Inventory System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-30T12:00:09.633Z

Reserved: 2026-08-29T17:40:53.187Z

Link: CVE-2026-82541

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-30T12:17:19.390

Modified: 2026-08-30T12:17:19.390

Link: CVE-2026-82541

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-30T13:30:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')