CVE-2026-78656: SQL Injection in itsourcecode Sales and Inventory System

This vulnerability affects itsourcecode Sales and Inventory System 1.0. An attacker can remotely exploit an SQL injection flaw by manipulating the ID argument in the /pages/cust_del.php file. This allows unauthorized SQL commands to be executed against the backend database. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low privileges required, and no user interaction needed. Public exploit code exists, increasing the risk of exploitation. No vendor advisory or patch information is provided.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability requires low privileges and no user interaction, making remote exploitation feasible. However, the impact is rated medium severity, indicating limited or partial compromise potential.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the vulnerable endpoint and monitoring for suspicious activity related to the ID parameter. Avoid exposing the affected system to untrusted networks if possible.