Sales and Inventory System EUVD-2026-65305

Exploitation requires a valid low-privilege authenticated session on the itsourcecode Sales and Inventory System (CVSS PR:L confirmed). The vulnerable code path is the /pages/cust_del.php customer-deletion handler, which processes the ID parameter without sanitization; no non-default configuration or special feature flag is required - any standard deployment of version 1.0 with the customer management module accessible is vulnerable. Exploitation is bounded by the authentication prerequisite: unauthenticated internet-facing attacks against default configurations are not possible. An attacker must first acquire valid application credentials through phishing, credential stuffing, insider access, or another pre-authentication vulnerability. Once authenticated, no further privilege escalation or user interaction is needed to trigger the injection.

The CVSS 4.0 score of 2.1 (Low) with base vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N reflects a network-reachable flaw requiring low-privilege authentication, with limited confidentiality, integrity, and availability impact and no scope change to subsequent systems. The E:P threat modifier confirms publicly available exploit code, meaningfully lowering the exploitation barrier for any attacker who has already obtained credentials. Despite the low composite score, SQL injection with a live POC against a customer database represents a meaningful data-exposure event for any organization actually running this software in production - read/write access to customer records could enable data theft, fraudulent deletions, or business disruption. No CISA KEV listing means active widespread exploitation has not been confirmed; absence of a KEV entry combined with low EPSS signals opportunistic rather than targeted mass exploitation. The primary limiting factor is the PR:L requirement: an attacker must first possess valid application credentials, which constrains the realistic threat population to insiders, phishing victims, or credential-stuffing scenarios.

An attacker who has obtained low-privilege credentials - through phishing, credential stuffing against a publicly exposed login page, or insider access - sends a crafted HTTP GET or POST request to /pages/cust_del.php with a malicious ID parameter such as '1 OR 1=1 UNION SELECT ...'. A publicly available proof-of-concept on GitHub (https://github.com/ltranquility/vuln_submit/issues/28) demonstrates the technique, enabling enumeration of customer records or bulk deletion of inventory data.