A flaw has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. (CVE-2026-114250)

The itsourcecode Sales-and-Inventory-System up to commit 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac contains a SQL injection vulnerability in the /pages/cust_edit.php endpoint. This vulnerability arises from improper processing of the ID argument, allowing remote attackers to inject SQL commands. The project employs continuous delivery with rolling releases, preventing clear identification of affected or patched versions. Although the vulnerability was reported early, the project has not responded or issued a fix. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation of this SQL injection vulnerability could allow an attacker with low privileges to execute arbitrary SQL commands remotely, potentially leading to unauthorized data access, modification, or denial of service. The CVSS score of 6.3 reflects a moderate impact with low complexity and no user interaction required. However, the lack of a vendor response or patch increases exposure risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or released a fix, users should consider implementing application-level mitigations such as input validation and parameterized queries for the ID parameter in /pages/cust_edit.php. Monitor for updates from the vendor and apply patches promptly once available.