Description
A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/cust_edit1.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-09-07
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A remote attacker can manipulate the ID argument in the cust_edit1.php page of itsourcecode Sales and Inventory System 1.0, leading to SQL injection. This flaw permits the execution of arbitrary SQL commands against the underlying database. If exploited, the attacker could read, modify, or delete sensitive data such as customer records and transaction details, potentially compromising confidentiality, integrity, and availability of the system.

Affected Systems

The vulnerability affects the itsourcecode Sales and Inventory System, specifically version 1.0. The affected element is an undisclosed function within the file /pages/cust_edit1.php. The issue is present in the product as distributed by itsourcecode.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available, but the vulnerability is known to be publicly disclosed and can be leveraged remotely. It is not listed in CISA’s KEV catalog. The likely attack vector is remote, exploiting the ID parameter through crafted requests, with no local user interaction required.

Generated by OpenCVE AI on September 7, 2026 at 15:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to a patched or newer version of the Sales and Inventory System once a vendor release containing the fix is available
  • If an update is unavailable, protect the application by implementing input validation or parameterized queries on the ID argument in cust_edit1.php to eliminate the injection path
  • Deploy a web application firewall or equivalent security controls to detect and block malicious SQL injection attempts
  • Review and restrict database permissions for the application account so that even if injection occurs, the damage is limited

Generated by OpenCVE AI on September 7, 2026 at 15:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 07 Sep 2026 14:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/cust_edit1.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Title itsourcecode Sales and Inventory System cust_edit1.php sql injection
First Time appeared Itsourcecode
Itsourcecode sales And Inventory System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:sales_and_inventory_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode sales And Inventory System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Sales And Inventory System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-07T14:00:08.818Z

Reserved: 2026-09-06T18:34:43.887Z

Link: CVE-2026-86310

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-07T14:16:56.457

Modified: 2026-09-07T14:16:56.457

Link: CVE-2026-86310

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T16:00:13Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')