CVE-2026-114252: SQL Injection in itsourcecode Sales-and-Inventory-System

This vulnerability allows remote attackers to perform SQL injection by manipulating the ID parameter in an unknown function in /pages/cust_searchfrm.php of the itsourcecode Sales-and-Inventory-System. The system uses a rolling release model, making it difficult to pinpoint exact affected versions. The vulnerability was responsibly disclosed but remains unpatched. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability affects confidentiality, integrity, and availability with low impact levels. Since the exploit is publicly available, the risk of exploitation is increased. However, no known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. In the meantime, restricting access to the vulnerable endpoint and applying web application firewall (WAF) rules to detect and block SQL injection attempts may reduce risk.