Description

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/pro_del.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-06T04:18:30.320Z",
  "pubdate": "2026-09-06T04:18:30.320Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the itsourcecode Sales and Inventory System 1.0, specifically within the /pages/pro_del.php script.\nThe vulnerability arises from the improper sanitization of the 'ID' parameter, which is processed directly in database queries.\nSuccessful exploitation allows a remote, unauthenticated attacker to manipulate backend database queries, potentially leading to unauthorized data exfiltration, modification, or complete compromise of the database integrity.\nThe vulnerability poses a severe risk as exploits are publicly available, lowering the barrier for entry for malicious actors.\nOrganizations utilizing this version of the Sales and Inventory System are at high risk of data breaches and database manipulation due to the lack of input validation on the affected endpoint.",
  "technicalDetails": "The vulnerability is classified as a SQL injection (SQLi) flaw located within the /pages/pro_del.php file of the itsourcecode Sales and Inventory System 1.0.\nThe root cause of this security defect is the failure of the application to implement adequate server-side input validation or parameterized queries (prepared statements) when handling the 'ID' parameter supplied via HTTP requests.\nWhen an attacker sends a crafted request containing malicious SQL syntax to the /pages/pro_del.php file, the application incorporates this input directly into the database query execution string without neutralization of special characters.\nThe attack flow begins with the adversary identifying the /pages/pro_del.php endpoint. By submitting a manipulated 'ID' argument—typically via GET or POST parameters—the attacker can alter the logic of the SQL statement being executed by the underlying database management system (DBMS).\nGiven that the 'ID' parameter is used in a deletion context, the injection may allow the attacker to bypass access controls, execute administrative database commands, or perform UNION-based queries to extract sensitive information from other tables within the database schema.\nBecause the vulnerability is remotely exploitable, it does not require physical access to the server, and the public availability of exploit code facilitates automated or script-kiddie attacks.\nThe impact of a successful exploitation is high, potentially leading to full unauthorized access to the application's data. This includes the ability to view, modify, or delete records from the inventory and sales databases, which are core components of the system.\nFurthermore, depending on the database configuration and the privileges of the web application's database user, this flaw could be escalated to perform operations that affect the underlying server environment, such as file reads or writes, significantly increasing the scope of the compromise."
}