Sales-and-Inventory-System CVE-2026-114250

Exploitation requires authenticated access at low privilege (CVSS PR:L) and network reachability of the /pages/cust_edit.php endpoint, with the malicious payload supplied through the ID parameter - the vulnerable code path is the customer-edit page's handling of that argument. No user interaction is needed (UI:N) and complexity is low (AC:L), but the authentication prerequisite is the primary limiting factor, preventing fully unauthenticated mass exploitation. A further practical limit is that no fixed release exists (rolling releases, unresponsive vendor), so defenders must mitigate at the application or input-validation layer rather than by patching to a known version.

This is a moderate, not high-priority, issue despite being remotely reachable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes network-based, low-complexity exploitation requiring low-level authentication (PR:L), with only partial impact across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), yielding a medium base score of 5.3. Exploit maturity is Proof-of-Concept (E:P), consistent with the publicly available exploit referenced via a GitHub issue - meaning exploit code exists but there is NO evidence of active, widespread exploitation. The CVE is NOT listed in CISA KEV, and no EPSS score was provided in the input, so real-world exploitation probability cannot be quantified from the available signals. The PR:L requirement means an attacker needs some valid account/session before reaching the vulnerable customer-edit endpoint, which meaningfully limits opportunistic mass exploitation. The dominant risk-reducing factor is the product itself: itsourcecode Sales-and-Inventory-System is a small open-source/educational PHP project with negligible production footprint, so even a trivially exploitable SQLi affects very few real deployments. Net: a legitimate, exploit-published SQL injection flaw, but low real-world priority because of limited impact (partial C/I/A), authentication prerequisite, and near-zero deployment scale.

An authenticated low-privilege user sends a crafted value in the ID parameter to /pages/cust_edit.php, injecting SQL that the application concatenates into a database query. A proof-of-concept exploit has been published (via the project's GitHub issue tracker), allowing the attacker to read or tamper with customer records in the backend database. Because the attack vector is network-based with low complexity, it can be performed remotely over HTTP once the attacker holds any valid session.