CVE-2026-82422: SQL Injection in itsourcecode Sales and Inventory System

This vulnerability involves SQL injection in itsourcecode Sales and Inventory System 1.0. Specifically, the ID parameter in the /pages/emp_del.php file is vulnerable to manipulation, enabling an attacker to execute arbitrary SQL commands remotely. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Public exploit code has been released, but there is no information on an official fix or patch from the vendor.

Successful exploitation of this vulnerability could allow an attacker to execute unauthorized SQL commands on the backend database, potentially leading to data disclosure, modification, or deletion. Since the attack vector is remote and requires no user interaction, it increases the risk of exploitation. However, the CVSS vector indicates low privileges required and limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter in /pages/emp_del.php. Additionally, review and harden input validation and parameter sanitization in the affected application component.