Description

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_searchfrm.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-30T12:17:19.190Z",
  "pubdate": "2026-08-30T12:17:19.190Z",
  "executiveSummary": "The Sales and Inventory System 1.0 contains a critical SQL injection vulnerability within the /pages/cust_searchfrm.php file. This flaw allows a remote, unauthenticated attacker to manipulate the ID argument to inject arbitrary SQL commands into the backend database. By successfully exploiting this vulnerability, an attacker can bypass security controls to perform unauthorized data extraction, modification, or deletion. Given that proof-of-concept exploit code is publicly available, the risk of exploitation is high. This vulnerability presents a significant threat to data confidentiality, integrity, and availability, potentially leading to full compromise of the database associated with the application.",
  "technicalDetails": "The vulnerability resides in the /pages/cust_searchfrm.php script of the Sales and Inventory System 1.0. The root cause is improper neutralization of special elements used in an SQL command, specifically within the handling of the 'ID' parameter. The application fails to sanitize or parameterize user-supplied input before incorporating it into a database query string.\nExploitation occurs via a crafted HTTP request where the ID parameter is modified to include malicious SQL syntax. Because the application processes this input without adequate validation, the injected code is executed by the backend database management system. An attacker can leverage this primitive to perform various operations, such as UNION-based SQL injection to retrieve sensitive data from other tables, error-based injection to map the database schema, or boolean-based blind injection to exfiltrate information character by character.\nThe attack flow begins when an attacker identifies the vulnerable /pages/cust_searchfrm.php endpoint. The attacker then probes the ID parameter by injecting characters such as a single quote (') to trigger syntax errors or using SQL comment sequences to disrupt the original query structure. Once the injection point is confirmed, the attacker can craft sophisticated payloads to dump user credentials, system configuration details, or sensitive business records. Since the vulnerability is remotely accessible, the attacker requires no prior authentication to interact with the target script. This flaw constitutes a classic injection attack vector where the application trust boundary is compromised by failing to treat user input as data rather than executable code. Post-exploitation impact ranges from unauthorized information disclosure to potentially full database takeover if the database service account has excessive privileges within the environment."
}