CVE-2026-114250: SQL Injection in itsourcecode Sales-and-Inventory-System

This vulnerability involves an SQL injection in the itsourcecode Sales-and-Inventory-System up to commit 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. The injection occurs via manipulation of the ID parameter in /pages/cust_edit.php. The attack can be launched remotely without user interaction and requires low attack complexity and privileges. The product's continuous delivery model means no discrete version numbers are available to delineate affected or patched releases. The vendor has been notified but has not provided a response or patch. Exploit code is publicly available.

Successful exploitation allows remote attackers to perform SQL injection attacks, potentially leading to unauthorized data access or modification within the Sales-and-Inventory-System database. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity), indicating moderate impact with low attack complexity and no user interaction required. No confirmed reports of active exploitation in the wild exist.

No official patch or remediation is currently available as the vendor has not responded. Users should monitor the vendor's communications for updates. Until a fix is released, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the /pages/cust_edit.php endpoint. Review and restrict access privileges where possible to limit potential impact.