Sales and Inventory System CVE-2026-82422

Exploitation requires a valid low-privileged authenticated session on the itsourcecode Sales and Inventory System - an unauthenticated attacker cannot reach the /pages/emp_del.php endpoint without first logging in. The CVSS 4.0 vector (PR:L) confirms this low-privilege requirement. No special server configuration, non-default feature, or unusual deployment mode is needed beyond standard installation of version 1.0. The limiting factor is the authentication gate: an attacker must possess or obtain valid credentials (even low-level ones) before injecting SQL. Network access to the web application is also required (AV:N).

The CVSS 4.0 base score of 5.3 reflects a moderate but meaningful risk profile: network-accessible (AV:N), low complexity (AC:L), no attack prerequisites (AT:N), low privileges required (PR:L), and limited impact across confidentiality, integrity, and availability (VC:L/VI:L/VA:L). The E:P supplemental metric confirms a public proof-of-concept exists, which materially lowers the exploitation barrier - any attacker with a low-privileged account can leverage existing tooling. There is no CISA KEV listing, and EPSS data was not provided in the input, so exploitation prevalence in the wild is unconfirmed. The absence of scope change (SC:N/SI:N/SA:N) limits blast radius to the vulnerable system's database. Real-world risk is further constrained by the product's extremely narrow deployment footprint - this is a niche, student-oriented PHP application with no significant enterprise presence - meaning the aggregate population of exposed instances is small. The combination of a public POC and low authentication bar warrants prompt patching for any operator running this software, even if the overall population-level threat is limited.

An attacker with a low-privileged account on the Sales and Inventory System - such as a standard employee user - sends a crafted HTTP request to /pages/emp_del.php with a malformed 'ID' parameter containing SQL metacharacters, such as a boolean-based or UNION-based injection payload. This allows the attacker to extract sensitive database contents (employee records, credentials, sales data) or modify/delete records beyond their intended authorization. A public proof-of-concept exists at the referenced GitHub issue, reducing the skill threshold to near-zero for any authenticated user.