CVE-2026-82485: SQL Injection in itsourcecode Sales and Inventory System

This vulnerability affects itsourcecode Sales and Inventory System version 1.0. It arises from improper handling of the ID parameter in the /pages/pro_edit.php file, enabling an attacker to inject SQL commands remotely. The CVSS 4.0 base score is 5.3, indicating a medium impact with network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official fix or vendor advisory has been published yet, and no known exploits are reported in the wild beyond the public disclosure.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impact as per the CVSS vector. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable functionality and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the affected endpoint to untrusted networks if possible.