Description

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/sup_del.php?type=supplier. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-06T23:17:39.323Z",
  "pubdate": "2026-09-06T23:17:39.323Z",
  "executiveSummary": "A SQL injection vulnerability has been identified in the itsourcecode Sales and Inventory System 1.0. The vulnerability exists within the /pages/sup_del.php file, specifically affecting the ID argument when type=supplier is passed. This flaw allows an unauthenticated remote attacker to execute arbitrary SQL commands against the underlying database.\nBy manipulating the ID parameter, an attacker can bypass security controls to access, modify, or delete sensitive data stored within the database. The availability of public exploit code increases the risk, as it lowers the barrier for malicious actors to conduct successful attacks against exposed instances. This vulnerability poses a significant risk to the confidentiality, integrity, and availability of the application's data.",
  "technicalDetails": "The vulnerability is a classic SQL injection flaw located in the /pages/sup_del.php file. The application fails to adequately sanitize or parameterize user-supplied input provided via the ID URL argument before incorporating it into a database query. When the script is accessed with the parameter type=supplier, the application processes the ID parameter in a way that allows for the injection of arbitrary SQL syntax.\nThe attack flow begins with a remote attacker crafting a malicious HTTP request targeting /pages/sup_del.php. By appending a specially crafted SQL payload to the ID parameter, the attacker can manipulate the structure of the backend SQL query. Because the application logic does not employ prepared statements or utilize sufficient input validation, the injected malicious code is parsed and executed by the database management system.\nExploitation is possible from remote network locations, allowing unauthorized actors to perform operations without prior authentication or privilege requirements. The impact of a successful exploitation is severe. An attacker can leverage this access to perform various malicious activities, including unauthorized data extraction (dumping sensitive information from the database), modification of existing records, or deletion of critical business data. Furthermore, depending on the database configuration and the privileges assigned to the database user account, an attacker may be able to gain additional access to the underlying server environment, leading to full system compromise.\nThe vulnerability is specific to version 1.0 of the itsourcecode Sales and Inventory System. Because the exploit is publicly documented, systems running this version are at immediate risk of exploitation by automated scanners or targeted attacks. The absence of robust input filtering and the use of direct string concatenation when building SQL queries represent the fundamental root cause of this security failure."
}