Description
A weakness has been identified in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/sup_del.php?type=supplier. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Published: 2026-09-06
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw exists in the /pages/sup_del.php endpoint of itsourcecode Sales and Inventory System 1.0 that allows an attacker to supply a crafted ID parameter, resulting in SQL code injection. This vulnerability can be exploited remotely to execute arbitrary SQL statements against the application database, potentially exposing, modifying, or deleting sensitive information. The weakness aligns with CWE-74 (Untrusted Search Path) and CWE-89 (SQL Injection).

Affected Systems

The vulnerable component is the itsourcecode Sales and Inventory System, version 1.0. The specific file is /pages/sup_del.php accessed via the query string parameter type=supplier. No further version details or additional products are documented.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, though a publicly available exploit exists. Attackers can invoke the flaw by manipulating the ID argument from an external location, and the vulnerability is exploitable without additional preconditions beyond remote access to the web interface.

Generated by OpenCVE AI on September 7, 2026 at 00:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor‑released patch or upgrade to a newer version of itsourcecode Sales and Inventory System.
  • Replace or extend the existing code so that the ID parameter is validated to be numeric and is used only within a parameterized SQL statement or stored procedure.
  • Configure a web application firewall to block or flag suspicious SQL injection patterns targeting the /pages/sup_del.php endpoint.

Generated by OpenCVE AI on September 7, 2026 at 00:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 06 Sep 2026 23:15:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/sup_del.php?type=supplier. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Title itsourcecode Sales and Inventory System sup_del.php sql injection
First Time appeared Itsourcecode
Itsourcecode sales And Inventory System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:sales_and_inventory_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode sales And Inventory System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Sales And Inventory System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-06T23:00:10.172Z

Reserved: 2026-09-06T08:13:09.534Z

Link: CVE-2026-86232

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-06T23:17:39.323

Modified: 2026-09-06T23:17:39.323

Link: CVE-2026-86232

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T00:30:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')