CVE-2026-86163: SQL Injection in itsourcecode Sales and Inventory System

The vulnerability CVE-2026-86163 affects itsourcecode Sales and Inventory System version 1.0. It is a SQL injection issue caused by improper sanitization of the ID argument in the /pages/pro_del.php script. An attacker can remotely inject SQL commands by manipulating this parameter, potentially compromising the database. Public exploit code exists, but there are no known reports of active exploitation in the wild. No official patch or remediation guidance is currently provided by the vendor.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL queries on the backend database. This may lead to unauthorized data access, data modification, or other database-related impacts depending on the database privileges of the application. The vulnerability is remotely exploitable without user interaction, increasing the attack surface. However, the CVSS score and severity indicate a medium level of risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter in /pages/pro_del.php. Additionally, review and harden database permissions to limit potential damage from exploitation.