CVE-2026-86233

itsourcecode Sales and Inventory System us_del.php sql injection

View on CVE.org
Published Sep 6, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /pages/us_del.php?type=user. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

Analysis

AI-generated

Technical impact

A user-supplied ID parameter in the us_del.php page of itsourcecode Sales and Inventory System 1.0 is not properly sanitized. An attacker can manipulate this argument to inject arbitrary SQL statements, granting unauthorized read, modify, or delete privileges on the underlying database. This flaw is classified under CWE-74 (Unspecified Encoding or Escaping) and CWE-89 (SQL Injection). The impact includes potential disclosure of sensitive business data, data corruption, and loss of integrity.

Affected Systems

itsourcecode’s Sales and Inventory System version 1.0 is affected. The vulnerability specifically lies in the us_del.php file accessed via /pages/us_del.php?type=user, which is part of the publicly distributed edition of the application.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity, with remote exploitation possible as the flaw is triggered through web input. No EPSS value is available, and the issue is not listed in the CISA KEV catalog. An attacker with knowledge of the ID parameter can send crafted requests to the vulnerable endpoint and achieve SQL injection over the network, making the risk primarily a moderate confidentiality and integrity concern for systems still running version 1.0.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor’s security fix or upgrade to a patched version of itsourcecode Sales and Inventory System.
  • Ensure all user-supplied input such as the ID parameter is validated and bound with parameterized queries or prepared statements before being used in SQL statements.
  • Limit access to the us_del.php endpoint to authenticated users with appropriate permissions and consider applying role‑based access controls to prevent unauthorized database manipulation.

Generated by OpenCVE AI on September 7, 2026 at 00:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /pages/us_del.php?type=user. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Title itsourcecode Sales and Inventory System us_del.php sql injection
First Time appeared Itsourcecode
Itsourcecode sales And Inventory System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:sales_and_inventory_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode sales And Inventory System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 8, 2026, 3:01 PM
Reserved
Sep 6, 2026, 8:13 AM

View source JSON

Updated
Sep 8, 2026, 3:01 PM

JSON

Status
Deferred
Published
Sep 7, 2026, 12:17 AM
Modified
Sep 8, 2026, 4:18 PM

View source JSON

No data.

Updated
Sep 7, 2026, 12:30 AM

JSON