EUVD-2026-72047
GHSA-g72p-v6gq-4x7m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege application credentials
-
DeliveryAuthenticate to Sales and Inventory System
-
ExploitSend crafted HTTP request to /pages/pro_del.php with malicious ID parameter
-
ExecutionSQL injection executes arbitrary query against backend database
-
ImpactExfiltrate or corrupt inventory/sales data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to hold a valid low-privileged account on the Sales and Inventory System application (PR:L per CVSS 4.0 vector). The vulnerable endpoint /pages/pro_del.php must be accessible over the network, which is default for any web-hosted deployment. No special non-default configuration is required beyond a running PHP/MySQL instance serving the application. Exploitation is limited by the requirement for at least read-level authenticated access; unauthenticated external attackers cannot directly reach this endpoint without first obtaining credentials. Impact is bounded to the application's database schema - no scope change to other systems is indicated. |
| Impact | The CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) reflects a moderate-severity finding: low privilege is required (PR:L), meaning exploitation is gated behind authentication, and the impact across confidentiality, integrity, and availability is limited to the vulnerable system. A publicly available PoC (E:P) elevates urgency slightly, but the absence of a CISA KEV listing and the niche, educational-project nature of itsourcecode software substantially reduces real-world risk. No EPSS data was provided. The primary concern is deployments where the application has been placed in production - a scenario that is possible but atypical for this category of tutorial software. The wildcard CPE covers all versions, but only version 1.0 is described; the true affected version scope is not confirmed beyond that. |
| Exploit ScenarioDerived | An authenticated attacker - such as a low-privileged sales clerk with a valid login - sends a crafted HTTP request to /pages/pro_del.php with a manipulated ID parameter containing SQL syntax (e.g., ID=1 OR 1=1; DROP TABLE products--). The unsanitized parameter is embedded into the DELETE or SELECT query, allowing the attacker to enumerate database tables, exfiltrate product or customer data, or corrupt inventory records. A public PoC on GitHub (https://github.com/CSDVi/cve/issues/3) demonstrates the exploitation steps. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 06, 2026
SQL injection in itsourcecode Sales and Inventory System 1.0 allows a remote authenticated low-privileged user to manipulate the ID parameter in /pages/pro_del.php to read, modify, or partially disrupt the underlying database. The vulnerability is exploitable over the network with low complexity and carries a publicly available proof-of-concept. No vendor patch has been identified; the software is a free educational PHP project distributed by itsourcecode.com, limiting real-world production exposure.
RemediationAI
No vendor-released patch has been identified at time of analysis. Because the software is an educational code sample rather than a maintained product, an official fix is unlikely. For any production deployment, the immediate mitigation is to parameterize the SQL query in /pages/pro_del.php using PHP PDO prepared statements or MySQLi bind_param(), replacing the direct interpolation of the ID parameter. Additionally, restrict access to the /pages/pro_del.php endpoint to authenticated administrator roles only via application-level access controls or web server configuration (e.g., deny-by-default with role checks). Deploying a Web Application Firewall rule to block SQL metacharacters in the ID parameter provides a compensating control with minimal side effects. If the system is not in active use, decommission or take it offline entirely.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is a PHP-based Sales and Inventory management application distributed as open-source sample code by itsourcecode.com (CPE: cpe:2.3:a:itsourcecode:sales_and_inventory_system:*:*:*:*:*:*:*:*). The vulnerability is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input - specifically the 'ID' GET/POST parameter in the product deletion endpoint /pages/pro_del.php - is concatenated directly into a SQL query without parameterization or prepared statements. This classic pattern allows an attacker to append arbitrary SQL syntax, enabling data exfiltration, data modification, or potential database-level denial of service.
Know when Sales And Inventory System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable endpoint, low complexity, but PR:L required per CVSS 4.0 input; limited C/I/A impact consistent with bounded DB-level SQLi.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/pro_del.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in itsourcecode Sales and Inventory System SQL Injection
View all 2More in Sales And Inventory System
View allSQL injection vulnerability in SourceCodester Sales and Inventory System v 1.0 allows remote attackers to execute arbitr
A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. Rated medium severity
A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical.php. Rated medium sever
A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. Rated medium seve
Reflected cross-site scripting (XSS) in SourceCodester Sales and Inventory System 1.0 allows remote attackers to inject
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the login endpoint to unauthenticated remote exploi
A vulnerability, which was classified as critical, was found in Campcodes Sales and Inventory System 1.0. Rated medium s
CVE-2025-7538 is a critical unrestricted file upload vulnerability in Campcodes Sales and Inventory System version 1.0,
SQL injection in Campcodes Sales and Inventory System 1.0 allows remote attackers to execute arbitrary SQL commands via
CVE-2025-6311 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System version 1.0 affecting th
A security vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
SQL injection in Campcodes Sales and Inventory System 1.0 allows remote unauthenticated attackers to inject malicious SQ
Exploit-DB