Sales Inventory System CVE-2026-86164

Exploitation requires a valid low-privilege account on the itsourcecode Sales and Inventory System 1.0 instance, as the CVSS 4.0 vector specifies PR:L. The attacker must be able to reach the web application over a network (AV:N), but no additional attack requirements (AT:N) such as race conditions or specific configurations are needed beyond basic authenticated access. Exploitation is limited by the requirement for at least one valid user credential; unauthenticated exploitation is not supported by the available CVSS data. The application must be Internet- or network-accessible for remote exploitation. No specific non-default configuration is required - any standard deployment of the application with the trans_view.php page accessible is vulnerable.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-exploitable, low-complexity SQL injection requiring only low-privilege authentication - a meaningful but not insurmountable barrier. The partial impact ratings (VC:L/VI:L/VA:L) likely understate realistic SQLi outcomes; full table dumps and credential theft are common consequences even when the base score is computed conservatively. The exploit-maturity tag E:P confirms a public proof-of-concept exists, making opportunistic scanning and exploitation straightforward. No CISA KEV listing has been identified, and EPSS data is not provided, but the public PoC reduces time-to-exploitation significantly for any attacker who finds the instance exposed. The product is a student/SMB-grade PHP application with limited enterprise footprint, so mass exploitation is unlikely; even a mid-sized municipal IT team in opole would face negligible exposure unless they specifically deployed this open-source script in production. The primary real-world risk is to small businesses or educational environments where itsourcecode scripts are deployed without further hardening.

An attacker with a low-privilege account on the Sales and Inventory System navigates to /pages/trans_view.php?ID=1' UNION SELECT ...--, injecting a UNION-based payload that retrieves all usernames and password hashes from the database. Given the public exploit is already available on GitHub, an attacker can adapt the existing proof-of-concept with minimal effort, automating database extraction via tools such as sqlmap pointed at the vulnerable endpoint.