CVE-2026-82696: SQL Injection in itsourcecode Sales and Inventory System

This vulnerability affects itsourcecode Sales and Inventory System version 1.0. An attacker can exploit a SQL injection flaw in the /pages/inv_searchfrm.php file by manipulating the ID parameter. This allows unauthorized SQL commands to be executed on the backend database. The vulnerability is remotely exploitable without requiring user interaction. Public exploit code is available, but there are no known exploits observed in the wild. No official patch or remediation guidance has been provided by the vendor as of the publication date.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the vulnerability has a medium severity rating and the CVSS vector indicates low complexity and no privileges required, but some level of user privileges is needed. There is no indication of widespread exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is provided, users should monitor vendor channels for updates. Until a patch is available, restricting access to the vulnerable endpoint and implementing web application firewall rules to detect and block SQL injection attempts may reduce risk.