Description
A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /pages/us_del.php?type=user. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-09-06
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A user-supplied ID parameter in the us_del.php page of itsourcecode Sales and Inventory System 1.0 is not properly sanitized. An attacker can manipulate this argument to inject arbitrary SQL statements, granting unauthorized read, modify, or delete privileges on the underlying database. This flaw is classified under CWE-74 (Unspecified Encoding or Escaping) and CWE-89 (SQL Injection). The impact includes potential disclosure of sensitive business data, data corruption, and loss of integrity.

Affected Systems

itsourcecode’s Sales and Inventory System version 1.0 is affected. The vulnerability specifically lies in the us_del.php file accessed via /pages/us_del.php?type=user, which is part of the publicly distributed edition of the application.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity, with remote exploitation possible as the flaw is triggered through web input. No EPSS value is available, and the issue is not listed in the CISA KEV catalog. An attacker with knowledge of the ID parameter can send crafted requests to the vulnerable endpoint and achieve SQL injection over the network, making the risk primarily a moderate confidentiality and integrity concern for systems still running version 1.0.

Generated by OpenCVE AI on September 7, 2026 at 00:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor’s security fix or upgrade to a patched version of itsourcecode Sales and Inventory System.
  • Ensure all user-supplied input such as the ID parameter is validated and bound with parameterized queries or prepared statements before being used in SQL statements.
  • Limit access to the us_del.php endpoint to authenticated users with appropriate permissions and consider applying role‑based access controls to prevent unauthorized database manipulation.

Generated by OpenCVE AI on September 7, 2026 at 00:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 06 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /pages/us_del.php?type=user. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Title itsourcecode Sales and Inventory System us_del.php sql injection
First Time appeared Itsourcecode
Itsourcecode sales And Inventory System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:sales_and_inventory_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode sales And Inventory System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Sales And Inventory System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-06T23:15:12.796Z

Reserved: 2026-09-06T08:13:13.562Z

Link: CVE-2026-86233

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-07T00:17:46.683

Modified: 2026-09-07T00:17:46.683

Link: CVE-2026-86233

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T00:30:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')