CVE-2026-90597 describes a SQL injection vulnerability in itsourcecode Sales and Inventory System 1.0. The flaw is located in an unknown function within /pages/sup_edit1.php, where manipulation of the ID argument leads to SQL injection. The vulnerability can be exploited remotely by an attacker with low privileges and does not require user interaction. The CVSS 3.1 base score is 6.3 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impact on confidentiality, integrity, and availability. Public exploit details have been disclosed, but no confirmed active exploitation is known. No vendor advisory or patch information is available.

Successful exploitation of this vulnerability can allow an attacker with low privileges to perform SQL injection attacks remotely, potentially leading to unauthorized access or modification of database information and partial disruption of service. The impact on confidentiality, integrity, and availability is rated low to medium based on the CVSS vector. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected system and monitor for suspicious activity related to SQL injection attempts targeting the ID parameter in /pages/sup_edit1.php.