The vulnerability CVE-2026-90700 affects itsourcecode Sales and Inventory System 1.0. It arises from improper sanitization of the 'prodcode' parameter in the /pages/pro_edit1.php file, allowing an attacker to perform SQL injection attacks remotely. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Public exploit details have been disclosed, but no vendor advisory or patch information is provided.

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate backend database queries, potentially leading to unauthorized data access or modification. The attack can be performed remotely without user interaction, increasing the risk. However, the CVSS vector indicates low privileges required and limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint and apply web application firewall rules to detect and block SQL injection attempts targeting the 'prodcode' parameter.