A vulnerability was found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. (CVE-2026-114252)

The itsourcecode Sales-and-Inventory-System contains a SQL injection vulnerability in an unknown function in /pages/cust_searchfrm.php. Manipulating the ID parameter allows an attacker to inject SQL commands remotely. The vulnerability has been publicly disclosed with exploit code available. Due to the rolling release model, no precise versioning information is available for affected or fixed releases. The project maintainers have been notified but have not provided a patch or response at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to data disclosure, data modification, or denial of service. The CVSS score of 6.3 indicates a moderate impact with low privileges required and no user interaction needed. The vulnerability is remotely exploitable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor for updates from the project. Until a fix is available, consider restricting access to the vulnerable functionality or applying web application firewall rules to detect and block SQL injection attempts targeting the ID parameter in /pages/cust_searchfrm.php.