Description
A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/cust_edit1.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-09-07
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL injection allowing arbitrary SQL execution and potential data exposure
Action: Immediate Patch
AI Analysis

Impact

A remote attacker can manipulate the ID argument in the cust_edit1.php page of itsourcecode Sales and Inventory System 1.0, leading to SQL injection. This flaw permits the execution of arbitrary SQL commands against the underlying database. If exploited, the attacker could read, modify, or delete sensitive data such as customer records and transaction details, potentially compromising confidentiality, integrity, and availability of the system.

Affected Systems

The vulnerability affects the itsourcecode Sales and Inventory System, specifically version 1.0. The affected element is an undisclosed function within the file /pages/cust_edit1.php. The issue is present in the product as distributed by itsourcecode.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available, but the vulnerability is known to be publicly disclosed and can be leveraged remotely. It is not listed in CISA’s KEV catalog. The likely attack vector is remote, exploiting the ID parameter through crafted requests, with no local user interaction required.

Generated by OpenCVE AI on September 7, 2026 at 15:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to a patched or newer version of the Sales and Inventory System once a vendor release containing the fix is available
  • If an update is unavailable, protect the application by implementing input validation or parameterized queries on the ID argument in cust_edit1.php to eliminate the injection path
  • Deploy a web application firewall or equivalent security controls to detect and block malicious SQL injection attempts
  • Review and restrict database permissions for the application account so that even if injection occurs, the damage is limited

Generated by OpenCVE AI on September 7, 2026 at 15:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 07 Sep 2026 14:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/cust_edit1.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Title itsourcecode Sales and Inventory System cust_edit1.php sql injection
First Time appeared Itsourcecode
Itsourcecode sales And Inventory System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:sales_and_inventory_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode sales And Inventory System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Sales And Inventory System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-11T20:34:53.693Z

Reserved: 2026-09-06T18:34:43.887Z

Link: CVE-2026-86310

cve-icon Vulnrichment

Updated: 2026-09-11T20:04:52.540Z

cve-icon NVD

Status : Deferred

Published: 2026-09-07T14:16:56.457

Modified: 2026-09-11T21:17:45.477

Link: CVE-2026-86310

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T16:00:13Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')