CVE-2026-86234: SQL Injection in itsourcecode Sales and Inventory System

The vulnerability CVE-2026-86234 affects itsourcecode Sales and Inventory System version 1.0. It is an SQL injection issue in the /pages/cust_transac.php script when processing the 'firstname' argument during an 'add' action. This allows remote attackers to execute arbitrary SQL commands by manipulating the input parameter. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Exploit code is publicly available, increasing the risk of exploitation. No patch or vendor advisory is currently referenced.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries on the backend database, potentially leading to unauthorized data access or modification. The attack can be launched remotely without user interaction and requires low complexity, but some privileges are needed. The vulnerability is rated medium severity with a CVSS score of 5.3. No active exploitation in the wild has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries to mitigate SQL injection risks. Monitor for updates from itsourcecode regarding patches or official mitigations.