Sales-and-Inventory-System EUVD-2026-107285

Exploitation requires an authenticated session with at least low-level privileges on the Sales-and-Inventory-System application (per CVSS PR:L), after which the attacker sends a request to the specific endpoint /pages/cust_del.php with a manipulated ID parameter that is injected into a SQL query. Limiting factors: a valid login is needed, the flaw is confined to this single customer-delete page/parameter, and the product is unversioned with no vendor patch - so remediation currently depends on source-level code fixes rather than an upgrade. No special non-default configuration is required beyond having the application deployed and an account.

Signals are mixed but converge on a moderate, not urgent, priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with score 5.3 describes a remotely reachable, low-complexity SQL injection that nonetheless requires low-level privileges (PR:L), i.e. an authenticated account - so this is not a fully unauthenticated flaw. Impact is rated partial across the board (VC:L/VI:L/VA:L), consistent with a single injectable DELETE-page parameter rather than full database compromise. A public exploit exists (a GitHub issue PoC) and the vendor-assigned Exploit Maturity of E:P (Proof-of-Concept) confirms this, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation. The dominant risk-limiting factors are the required authentication and the very narrow real-world footprint of this product (a free PHP project from itsourcecode, not enterprise software). Net: a real, confirmed-reproducible bug worth patching for anyone running this exact application, but a low priority relative to the CVE landscape - the high-CVSS-but-low-real-risk framing fits because exploitation is gated by authentication and the affected product is obscure. Missing data to note: no EPSS probability was provided, so quantitative exploitation likelihood cannot be stated.

An attacker with a low-privileged authenticated session browses to /pages/cust_del.php and manipulates the ID parameter, injecting SQL that the page passes unsanitized into a query. Because a public proof-of-concept has been disclosed via a GitHub issue, an attacker can replicate the technique directly. The network-reachable, low-complexity nature (AV:N/AC:L) means the request is a simple crafted HTTP call once the attacker is logged in.