EUVD-2026-70856
GHSA-66q3-jgvh-847r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged application credentials
-
DeliveryAuthenticate to Sales and Inventory System
-
ExploitSend crafted HTTP request to /pages/inv_del.php with malicious ID parameter
-
ExecutionInjected SQL executes in backend database
-
ImpactExtract or modify database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires at least low-privileged authenticated access to the Sales and Inventory System application (CVSS PR:L), meaning the attacker must hold a valid user account and be able to log into the interface and reach the |
| Impact | The CVSS 4.0 score of 5.3 (Medium) accurately reflects the combination of factors: network-accessible attack vector with low complexity but a meaningful prerequisite of authenticated access (PR:L), with low-level impact across all three CIA dimensions. The public PoC on GitHub (E:P) elevates practical risk for any exposed instances. No EPSS data was provided and no CISA KEV listing exists, indicating no confirmed widespread or targeted exploitation. The narrow deployment footprint of this educational PHP codebase further constrains real-world impact. The scope change metrics (SC:N/SI:N/SA:N) confirm impact is limited to the vulnerable application's own database, with no lateral pivot risk. Overall, this is a medium-severity finding that demands remediation on any internet-exposed instance but presents low systemic risk given the product's rarity in production. |
| Exploit ScenarioDerived | An attacker with a valid low-privileged account on the Sales and Inventory System sends a crafted HTTP request to |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the unsanitized ID parameter in /pages/inv_del.php, enabling database enumeration, data extraction, and record modification. The application is an educational PHP project from itsourcecode.com with minimal production exposure, and a public proof-of-concept exploit has been published on GitHub. No vendor-released patch has been identified at time of analysis.
RemediationAI
No vendor-released patch has been identified at time of analysis for itsourcecode Sales and Inventory System 1.0. The primary fix is to refactor /pages/inv_del.php to use parameterized queries or prepared statements (e.g., PDO or MySQLi prepared statements in PHP) for the ID parameter, eliminating the injection point at the code level. As an immediate compensating control, deploy a web application firewall rule to block SQL metacharacter sequences in the ID parameter; note that WAF rules can be bypassed by advanced encodings and are not a substitute for code-level fixes. If the application is publicly internet-facing, restricting access to authenticated and trusted internal users via network-level controls (firewall, VPN) will materially reduce the attack surface. The VulDB advisory and PoC reference are at vuldb.com/vuln/398537 and github.com/ltranquility/submit_repository/issues/3.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic SQL injection (CWE-89) in a PHP-based sales and inventory management application. The file /pages/inv_del.php processes an inventory deletion operation using an ID parameter that is concatenated directly into a SQL query without prepared statements or adequate sanitization, allowing an attacker to alter query logic. The CPE cpe:2.3:a:itsourcecode:sales_and_inventory_system:*:*:*:*:*:*:*:* covers all versions of the application. itsourcecode.com distributes open-source PHP learning projects rather than enterprise software, meaning this codebase is likely used in educational or hobbyist contexts rather than hardened production deployments.
Know when Sales And Inventory System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable SQLi requiring authenticated access (PR:L); low CIA impact as the scope is limited to the application's own database with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_del.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Sales And Inventory System
View allSQL injection vulnerability in SourceCodester Sales and Inventory System v 1.0 allows remote attackers to execute arbitr
A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. Rated medium severity
A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical.php. Rated medium sever
A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. Rated medium seve
Reflected cross-site scripting (XSS) in SourceCodester Sales and Inventory System 1.0 allows remote attackers to inject
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the login endpoint to unauthenticated remote exploi
A vulnerability, which was classified as critical, was found in Campcodes Sales and Inventory System 1.0. Rated medium s
CVE-2025-7538 is a critical unrestricted file upload vulnerability in Campcodes Sales and Inventory System version 1.0,
SQL injection in Campcodes Sales and Inventory System 1.0 allows remote attackers to execute arbitrary SQL commands via
CVE-2025-6311 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System version 1.0 affecting th
A security vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
SQL injection in Campcodes Sales and Inventory System 1.0 allows remote unauthenticated attackers to inject malicious SQ
Exploit-DB