CVE-2026-82545: SQL Injection in itsourcecode Sales and Inventory System

The vulnerability CVE-2026-82545 affects itsourcecode Sales and Inventory System version 1.0. It is a SQL injection issue caused by improper sanitization of the ID parameter in the /pages/sup_searchfrm.php file. An attacker can remotely manipulate this parameter to inject SQL commands, potentially impacting the confidentiality, integrity, and availability of the database. The vulnerability is publicly disclosed, but no official patch or remediation has been provided by the vendor. The CVSS 3.1 base score is 5.3, indicating medium severity.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion. The vulnerability requires no user interaction and can be triggered remotely, increasing its risk. However, no known active exploitation in the wild has been reported.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restricting access to the vulnerable endpoint and employing web application firewalls that detect and block SQL injection attempts may help mitigate risk.