Description
A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_del.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
Published: 2026-09-04
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is located in the unknown function of inv_del.php in Sales and Inventory System 1.0. Manipulating the ID argument can trigger an SQL injection, allowing an attacker to execute arbitrary SQL commands, which may lead to data exposure, unauthorized data modification, or deletion.

Affected Systems

The affected product is itsourcecode Sales and Inventory System version 1.0.

Risk and Exploitability

The vulnerability has a CVSS score of 5.3, indicating moderate severity, and no EPSS data is available. It is not listed in the CISA KEV catalog. The attack can be carried out remotely by sending a crafted HTTP request to /pages/inv_del.php with a malicious ID parameter. An exploit has already been published, so the risk of real‑world attacks is present and should be treated as moderate.

Generated by OpenCVE AI on September 4, 2026 at 03:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Implement parameterized SQL queries for the delete operation to eliminate string concatenation
  • Validate and sanitize the ID parameter before using it in any database call
  • Restrict access to inv_del.php to authorized users and monitor logs for suspicious activity

Generated by OpenCVE AI on September 4, 2026 at 03:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 02:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_del.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
Title itsourcecode Sales and Inventory System inv_del.php sql injection
First Time appeared Itsourcecode
Itsourcecode sales And Inventory System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:sales_and_inventory_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode sales And Inventory System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Sales And Inventory System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-04T01:45:06.618Z

Reserved: 2026-09-03T17:57:02.063Z

Link: CVE-2026-85383

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T02:17:20.187

Modified: 2026-09-04T02:17:20.187

Link: CVE-2026-85383

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T03:30:13Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')