Description

A flaw has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is the function mysqli_query of the file /pages/us_searchfrm.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-08T04:17:42.307Z",
  "pubdate": "2026-09-08T04:17:42.307Z",
  "executiveSummary": "The itsourcecode Sales and Inventory System 1.0 is affected by an SQL injection vulnerability located in the /pages/us_searchfrm.php file. This security flaw stems from the improper sanitization of user-supplied input passed to the mysqli_query function.\nA remote, unauthenticated attacker can exploit this vulnerability by manipulating the 'ID' argument to inject malicious SQL queries. Successful exploitation allows an attacker to execute arbitrary SQL commands against the backend database, potentially resulting in unauthorized data access, modification, or deletion.\nGiven that the exploit code has been publicly disclosed, the risk of exploitation is elevated. Impacted organizations are advised to prioritize remediation to protect the confidentiality, integrity, and availability of their inventory and sales data.",
  "technicalDetails": "The vulnerability resides in the processing logic of the /pages/us_searchfrm.php file within the itsourcecode Sales and Inventory System 1.0. The application fails to adequately validate or parameterize the 'ID' input parameter before incorporating it into a database query.\nThe root cause is the usage of unsanitized input in the mysqli_query function. By injecting crafted SQL sequences into the 'ID' argument, an attacker can alter the intended logic of the SQL statement. Because the application interacts directly with the database using this concatenated input, it is susceptible to standard SQL injection techniques, including union-based attacks or blind SQL injection, depending on how the application handles the query results.\nThe attack flow begins with the attacker identifying the target endpoint at /pages/us_searchfrm.php. The attacker then crafts an HTTP request, either GET or POST, containing a malicious payload within the 'ID' parameter. This payload typically consists of SQL syntax such as single quotes, comment indicators (e.g., -- or #), or UNION SELECT statements designed to bypass existing conditions or extract sensitive information from other tables within the database schema.\nUpon receiving the request, the server passes the unsanitized 'ID' parameter directly to the mysqli_query function, which executes the modified SQL statement against the backend database. The database processes the injected instructions as legitimate commands, returning unintended output to the attacker.\nSince this vulnerability is remotely exploitable, no localized access is required. The exploit does not mandate prior authentication, meaning any network-reachable user can trigger the vulnerability. Post-exploitation impact is severe, as an attacker could potentially dump database contents, bypass administrative authentication mechanisms, or execute administrative commands if the database user permissions are insufficiently restricted. The existence of public exploits significantly increases the probability of successful exploitation by malicious actors targeting this specific version of the software."
}