This vulnerability affects itsourcecode Sales and Inventory System 1.0. An unknown function in the file /pages/sup_edit1.php improperly handles the ID parameter, enabling an attacker to inject SQL commands remotely. The vulnerability is classified as medium severity with a CVSS 4.0 score of 5.3, indicating a network attack vector with low complexity and no user interaction required. The exploit has been publicly disclosed, but there is no information about active exploitation in the wild or vendor-provided fixes.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The attack can be performed remotely without user interaction and requires low attack complexity. However, the overall impact is rated medium due to limited privileges required and low scope and impact metrics.

No official patch or remediation information is provided by the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the affected endpoint and applying web application firewall rules to detect and block SQL injection attempts targeting the ID parameter in /pages/sup_edit1.php.