The vulnerability CVE-2026-78656 affects itsourcecode Sales and Inventory System version 1.0. It is caused by improper sanitization of the ID parameter in an unknown function of the /pages/cust_del.php file, leading to SQL injection. This allows remote attackers to inject malicious SQL commands via the ID argument. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. Public exploit code exists, but no official fix or patch has been published by the vendor.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely by manipulating the ID parameter. This may lead to unauthorized data access or modification. However, the impact is rated medium due to low confidentiality, integrity, and availability impacts as per the CVSS vector. There are no known active exploits in the wild at this time.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is released, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter in /pages/cust_del.php. Avoid exposing this vulnerable endpoint to untrusted networks if possible.