Description

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/pro_edit.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-30T09:16:46.623Z",
  "pubdate": "2026-08-30T09:16:46.623Z",
  "executiveSummary": "The Sales and Inventory System 1.0 is affected by a critical SQL Injection (SQLi) vulnerability, specifically located within the /pages/pro_edit.php component.\nThis vulnerability allows an unauthenticated or remote attacker to manipulate the 'ID' parameter, leading to the unauthorized execution of arbitrary SQL commands against the underlying database management system.\nThe lack of proper input sanitization and parameterization in the handling of the 'ID' argument poses a severe risk to data integrity, confidentiality, and availability.\nSuccessful exploitation enables an attacker to perform unauthorized database queries, potentially leading to data exfiltration, modification of inventory or sales records, or complete compromise of the database backend.\nAs the exploit has been publicly disclosed, the system is exposed to immediate risk, requiring prompt remediation to prevent weaponization by threat actors.",
  "technicalDetails": "The vulnerability resides within the /pages/pro_edit.php file of the Sales and Inventory System 1.0. The root cause is the insecure handling of the user-supplied 'ID' argument, which is directly concatenated into a SQL query string without adequate sanitization, validation, or the use of prepared statements.\nIn the context of this application, the 'ID' argument is likely expected to be an integer representing a unique product identifier. However, the backend logic fails to enforce this data type, permitting the injection of arbitrary SQL syntax. When the application receives a crafted request containing malicious SQL characters (such as single quotes, comments, or logical operators like OR 1=1), the database engine interprets these inputs as part of the intended query command.\nThe attack flow proceeds as follows: An attacker sends a crafted HTTP GET or POST request to the /pages/pro_edit.php endpoint, substituting the expected legitimate product ID with a malicious SQL payload. The server-side script processes this input and reconstructs a vulnerable SQL statement. Upon execution, the database interprets the attacker-supplied logic rather than treating it as literal data.\nThis vulnerability is reachable remotely and does not explicitly mandate prior authentication, depending on the implementation of the surrounding access controls. The impact of the exploitation is significant; by leveraging techniques such as UNION-based SQL injection, an attacker can extract sensitive information from other tables within the database, such as administrator credentials, user sessions, or detailed transaction logs. Furthermore, error-based or time-based injection techniques can be employed to perform reconnaissance on the database schema.\nPost-exploitation, an attacker may be able to modify inventory data, alter transaction records, or potentially escalate privileges if the database service account possesses excessive permissions. The public disclosure of the exploit significantly increases the probability of automated scanning and exploitation by opportunistic adversaries."
}