CVE-2026-82540: SQL Injection in itsourcecode Sales and Inventory System

The vulnerability CVE-2026-82540 affects itsourcecode Sales and Inventory System version 1.0. It is caused by improper sanitization of the ID parameter in an unknown function of the /pages/cust_searchfrm.php file, leading to SQL injection. This allows an attacker to remotely execute arbitrary SQL commands on the backend database. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low complexity, no privileges required, and no user interaction needed. Public exploit code is available, but no official patch or fix has been disclosed.

Successful exploitation can lead to unauthorized SQL command execution on the backend database, potentially allowing data disclosure, modification, or other impacts depending on the database and application context. The vulnerability can be exploited remotely without authentication or user interaction. The medium CVSS score reflects moderate impact and ease of exploitation.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisories for updates. Until a fix is released, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter in /pages/cust_searchfrm.php. Avoid exposing the vulnerable interface to untrusted networks if possible.