The vulnerability in itsourcecode Sales and Inventory System 1.0 involves an SQL injection flaw in an unknown function within /pages/cust_edit.php. By manipulating the ID parameter, an attacker can execute SQL injection remotely. The vulnerability is tracked as CVE-2026-78185 with a CVSS v3.1 score of 6.3, indicating a medium severity impact on confidentiality, integrity, and availability. Exploit code is publicly available, but no official patch or fix has been disclosed.

Successful exploitation allows an attacker with low privileges to remotely execute SQL injection attacks, potentially leading to unauthorized data access, modification, or denial of service. The CVSS vector indicates low attack complexity, no user interaction required, and impacts confidentiality, integrity, and availability to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is available at this time. Until a patch is released, users should consider restricting access to the vulnerable endpoint and monitor for exploitation attempts.