Simple POS and Inventory System CVE-2026-9446

Exploitation requires an authenticated session with high-privilege (administrator-level) access to the application, as confirmed by CVSS PR:H. The attacker must be able to reach the /admin/edit_customer.php endpoint over the network (AV:N), meaning the admin panel must be internet-accessible or the attacker must have network access to the host. No additional special configuration beyond a standard installation of Simple POS and Inventory System 1.0 is required once admin credentials are held. Factors limiting exploitation: the requirement for admin-level credentials is the primary barrier - unauthenticated or low-privilege users cannot trigger this vulnerability. Organizations that restrict admin panel access to internal networks or VPN, or that enforce strong credential practices, significantly reduce realistic risk. The low EPSS score (0.03%) supports the assessment that mass opportunistic exploitation is not occurring.

The real-world risk here is materially lower than the network-accessible nature of the flaw might suggest. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) confirms that exploitation requires high privileges - specifically administrative credentials - which substantially narrows the viable threat actor population to insiders, compromised admin accounts, or attackers who have already achieved admin-level access through a separate vector. The scored impact is uniformly Low across confidentiality, integrity, and availability within the vulnerable component, with no scope change to adjacent systems. EPSS at 0.03% (8th percentile) aligns with this limited exposure profile. The E:P modifier in the CVSS vector confirms proof-of-concept availability, which is corroborated by the public GitHub Gist. No conflicting signals are present between CVSS and EPSS - both point to a low-priority issue absent specific threat intelligence about targeted use. The primary elevated-risk scenario would be insider threat or post-compromise lateral movement, not opportunistic internet scanning. SourceCodester software is commonly deployed in academic and small-business contexts with weak credential hygiene, which modestly increases realistic risk within that deployment base.

An attacker with valid administrator credentials logs into the Simple POS and Inventory System admin panel and navigates to the edit customer functionality backed by /admin/edit_customer.php. By manipulating the ID parameter in the HTTP request - for example appending a SQL payload such as a UNION SELECT or boolean-based blind injection string - the attacker forces the underlying database query to return or modify unintended data. A public proof-of-concept is available on GitHub Gist (https://gist.github.com/c4ttr4ck/599151a2b90c1cd620933c992873c67a), lowering the technical skill required to exploit this flaw once admin access is obtained.