Sales and Inventory System EUVD-2026-64721

Exploitation requires network access to the web application and at minimum a low-privileged authenticated session (PR:L in the CVSS 4.0 vector), meaning the attacker must possess valid application credentials or have compromised a user account. The vulnerable endpoint is /pages/cust_edit.php and the specific injectable parameter is ID. No special non-default configuration is required beyond the application being reachable over the network with the customer edit feature accessible to the attacker's account role. Exploitation is limited by the authentication prerequisite - unauthenticated external attackers cannot directly trigger the vulnerability without first obtaining valid credentials. Impact is further bounded by the Low ratings across confidentiality, integrity, and availability, suggesting the SQL injection does not provide full database takeover or privilege escalation to the underlying OS.

The CVSS 4.0 score of 2.1 (Low) is notable for a network-reachable SQL injection: the suppressed score results from limited impact ratings across all three impact dimensions (VC:L/VI:L/VA:L) and the PR:L requirement, meaning exploitation is constrained to authenticated users. No EPSS score was provided in the input, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread active exploitation. However, a publicly available proof-of-concept exploit exists (GitHub issue linked via exploit reference), which the CVSS 4.0 supplemental metric E:P also acknowledges. The realistic risk profile is low: the product is niche tutorial code with minimal enterprise production deployment, the attacker must be authenticated, and the SQL injection's impact is bounded to low-severity data exposure and limited record manipulation. The low CVSS score is internally consistent with the input data - this is not a case of conflicting signals requiring reconciliation.

An authenticated user of the Sales and Inventory System navigates to the customer edit page and submits a crafted value in the ID parameter - for example, appending a SQL UNION or boolean-based payload - causing the backend PHP script to pass unsanitized input to the database engine. The attacker can enumerate database tables, extract credential hashes or customer PII, or modify inventory and sales records. A public proof-of-concept demonstrating this technique is available at https://github.com/ltranquility/vuln_submit/issues/27.