The vulnerability CVE-2026-90600 affects itsourcecode Sales and Inventory System version 1.0. It is a SQL injection issue caused by improper sanitization of the ID argument in the /pages/inv_edit1.php file. This allows an attacker to inject malicious SQL queries remotely without requiring user interaction or elevated privileges. The vulnerability has been publicly disclosed with available exploit code, but there are no known active exploits in the wild at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate the backend database queries. This may lead to unauthorized data access, data modification, or other database-related impacts depending on the application's database permissions. The vulnerability is remotely exploitable and does not require user interaction, increasing its potential risk.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict access to the vulnerable endpoint, apply web application firewall rules to detect and block SQL injection attempts, and monitor for suspicious activity related to the ID parameter in /pages/inv_edit1.php.