Sales and Inventory System CVE-2026-86291

Exploitation requires: (1) a valid authenticated session in the application (PR:L - any low-privilege user account suffices); (2) the target running exactly Sales and Inventory System 1.0 with the /pages/us_edit1.php endpoint present and network-accessible; (3) the application connected to a MySQL backend, as is the standard itsourcecode configuration. There are no additional special configurations required beyond basic deployment. Exploitation is limited by the authentication prerequisite - unauthenticated access is not possible per the PR:L CVSS vector. Further limiting factors include: the product's niche/educational deployment context, absence of a production-grade user base, and the fact that itsourcecode applications are rarely internet-facing in practice.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 at medium severity, reflecting low-privilege authenticated exploitation with partial confidentiality, integrity, and availability impact. The EPSS score is not provided, but the presence of a public PoC (E:P in the vector) meaningfully elevates near-term exploitation likelihood above baseline. No CISA KEV listing is present, consistent with this being a niche educational application unlikely to be deployed in critical infrastructure. Real-world risk is bounded by the product's rarity - itsourcecode applications are predominantly used in coursework and demo environments, not production systems handling sensitive data. The PR:L requirement means unauthenticated exploitation is not possible; an attacker must first obtain valid application credentials. The primary concern is insider threat or post-login SQL injection chaining in environments where the app is inadvertently exposed to the internet.

An attacker who holds any valid user account in a publicly exposed Sales and Inventory System 1.0 instance logs in and navigates to the user-edit endpoint, appending a SQL injection payload to the ID GET/POST parameter - for example, ID=1' UNION SELECT username,password,3 FROM users-- -. The submitted PoC on GitHub demonstrates this path, and the low complexity of the attack means automated scanning tools can trivially detect and exploit it. The attacker extracts credential hashes or sensitive inventory/sales records from the underlying MySQL database.