A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. (CVE-2026-82540)

This vulnerability in itsourcecode Sales and Inventory System 1.0 involves SQL injection via the ID parameter in the /pages/cust_searchfrm.php file. An attacker can remotely exploit this flaw by manipulating the ID argument to execute arbitrary SQL commands. The vulnerability is identified as CWE-74 and has a CVSS 3.1 base score of 6.3, reflecting low to moderate severity. There is no vendor advisory or patch information provided, and the affected versions are not explicitly stated.

Successful exploitation could lead to unauthorized access or modification of the database, impacting confidentiality, integrity, and availability of the system data. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and unchanged scope, with low impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint and validate or sanitize input parameters to mitigate SQL injection risks.