CVE-2026-82541: SQL Injection in itsourcecode Sales and Inventory System

This vulnerability affects itsourcecode Sales and Inventory System version 1.0. The issue is an SQL injection caused by improper sanitization of the ID parameter in the /pages/sup_edit.php file. An attacker can remotely manipulate this parameter to inject SQL commands. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low complexity, no privileges required, and no user interaction needed. No official fix or patch is currently documented, and the vendor has not provided remediation guidance.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This could lead to unauthorized data access, modification, or deletion depending on the database permissions. However, the CVSS impact metrics indicate low confidentiality, integrity, and availability impact, suggesting limited but non-negligible consequences.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisories for updates. In the meantime, restricting access to the vulnerable endpoint and applying web application firewall rules to detect and block SQL injection attempts may reduce risk.