Sales-and-Inventory-System EUVD-2026-107287

Requires an authenticated low-privilege session on the Sales-and-Inventory-System web application (CVSS PR:L), after which the attacker manipulates the ID argument of the /pages/cust_searchfrm.php customer search endpoint to inject SQL. No user interaction and no special non-default configuration are needed. The principal limiting factor is the authentication requirement - an attacker must first possess or acquire valid application credentials; there is no indication of unauthenticated reachability.

This is a moderate, not urgent, priority. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity SQL injection that nonetheless requires authentication (PR:L), and the vendor scored impact as only partial across all three dimensions (VC:L/VI:L/VA:L), yielding a 5.3 Medium. The E:P temporal flag and the public GitHub issue confirm that publicly available exploit code exists, but there is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or widespread exploitation - exploit availability and active exploitation are distinct, and only the former is established here. A notable caveat: SQL injection via an unsanitized ID parameter typically permits full read of the backing database, which would argue for a higher confidentiality impact than the VC:L the vendor assigned; the low impact rating may understate real consequence, so treat the 5.3 as a floor rather than a ceiling. The PR:L requirement and the product's tiny real-world footprint are the primary factors keeping overall risk modest.

An attacker who holds (or obtains) a low-privilege account on a deployed Sales-and-Inventory-System instance browses to the customer search form at /pages/cust_searchfrm.php and submits a crafted value in the ID parameter, injecting SQL into the underlying query. Because public proof-of-concept exploit code already exists (published via a GitHub issue), the attacker can reliably enumerate and exfiltrate customer and inventory records from the database. The attack is remote over the network with low complexity but requires prior authentication.