CVE-2026-78171: SQL Injection in itsourcecode Sales and Inventory System

This vulnerability affects itsourcecode Sales and Inventory System version 1.0. An attacker can remotely exploit an SQL injection flaw by manipulating the User argument in the /pages/processlogin.php file. The vulnerability allows unauthorized SQL commands to be executed, potentially compromising the database. The CVSS 4.0 base score is 6.9 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. The exploit has been publicly disclosed, but no vendor patch or fix has been referenced.

Successful exploitation can lead to unauthorized SQL command execution on the backend database, potentially exposing or modifying sensitive data. The impact is rated medium severity based on CVSS 4.0 scoring, indicating limited but significant risk to confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected system and consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the User parameter in /pages/processlogin.php.