CVE-2026-86309

itsourcecode Sales and Inventory System pro_searchfrm.php sql injection

View on CVE.org
Published Sep 7, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A flaw has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_searchfrm.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.

Analysis

AI-generated

Technical impact

A flaw in the Sales and Inventory System allows an attacker to inject arbitrary SQL by manipulating the ID parameter in the pro_searchfrm.php page. The vulnerability is an SQL injection that can be triggered remotely via an HTTP request. When exploited, an attacker could read, modify, or delete database records, potentially compromising confidentiality and integrity.

Affected Systems

The affected product is itsourcecode Sales and Inventory System version 1.0. The vulnerable code resides in pro_searchfrm.php; the system is a web‑based inventory and sales application.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog. However, the exploit code has been published and an attacker can initiate the attack remotely by sending a crafted request. Given the SQL injection nature, the risk of data compromise is significant if the vendors or administrators do not address the flaw promptly.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update to a patched version of Sales and Inventory System once the vendor releases a fix.
  • Apply strict input validation to the ID parameter, ensuring it accepts only numeric values or a safe format.
  • Restrict remote access to the pro_searchfrm.php endpoint, requiring authentication or limiting exposure to trusted networks.

Generated by OpenCVE AI on September 7, 2026 at 15:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_searchfrm.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.
Title itsourcecode Sales and Inventory System pro_searchfrm.php sql injection
First Time appeared Itsourcecode
Itsourcecode sales And Inventory System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:sales_and_inventory_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode sales And Inventory System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 8, 2026, 12:55 PM
Reserved
Sep 6, 2026, 6:20 PM

View source JSON

Updated
Sep 8, 2026, 12:55 PM

JSON

Status
Deferred
Published
Sep 7, 2026, 2:16 PM
Modified
Sep 8, 2026, 1:17 PM

View source JSON

No data.

Updated
Sep 7, 2026, 3:45 PM

JSON