CVE-2026-86309: SQL Injection in itsourcecode Sales and Inventory System

This vulnerability involves an SQL injection flaw in itsourcecode Sales and Inventory System 1.0. The issue arises from improper sanitization or validation of the ID parameter in the /pages/pro_searchfrm.php file, allowing remote attackers to inject malicious SQL commands. The vulnerability has been assigned CVE-2026-86309 with a CVSS 4.0 base score of 5.3, indicating a medium impact. Exploit code is publicly available, increasing the risk of exploitation. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The attack can be performed remotely without user interaction and requires low attack complexity and privileges. However, the overall impact is rated medium due to limited scope and vector complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewalls or input validation controls to mitigate SQL injection risks. Monitor for updates from the vendor regarding patches or official mitigations.