Sales and Inventory System CVE-2026-82485

Exploitation requires the attacker to hold a low-privilege authenticated session within the Sales and Inventory System application - unauthenticated exploitation is NOT supported per the CVSS 4.0 PR:L metric. The vulnerable endpoint /pages/pro_edit.php must be accessible over the network (standard web deployment). No special non-default configuration is required beyond the default installation of version 1.0; the flaw exists in the baseline application code. Exploitation is limited to: (1) possessing valid application credentials at any privilege level, and (2) network-level access to the web application. The impact is bounded by database-level permissions granted to the PHP application's database user.

The CVSS 4.0 score of 2.1 (Low) reflects the low impact ratings across confidentiality, integrity, and availability (VC:L/VI:L/VA:L) and the requirement for low-level privileges (PR:L), even though the attack vector is network-accessible with low complexity and no user interaction. The low CVSS score is partially at odds with the public POC availability on GitHub, which lowers the bar for exploitation significantly. However, real-world risk is further modulated by the narrow deployment footprint - itsourcecode.com distributes educational/tutorial-grade PHP applications unlikely to be deployed in enterprise production environments at scale. EPSS data is not provided; given the niche nature of the product, exploitation probability is likely low in absolute terms. The public exploit raises priority for any organization running this specific software. No CISA KEV listing is present, confirming no confirmed widespread active exploitation.

An authenticated attacker with a low-privilege account - such as a regular sales clerk user - submits a crafted HTTP request to /pages/pro_edit.php with a malicious SQL payload in the ID parameter (e.g., ID=1 UNION SELECT ...). The application forwards the unsanitized value directly into a SQL query, allowing the attacker to enumerate database tables, extract credentials or sensitive inventory/sales records, or modify data. A public proof-of-concept demonstrating this technique is available on GitHub, making exploitation trivial for any attacker with valid credentials.