itsourcecode Sales and Inventory System SQL Injection

SQL injection in itsourcecode Sales and Inventory System 1.0 allows a remote authenticated low-privileged user to manipulate the ID parameter in /pages/pro_del.php to read, modify, or partially disrupt the underlying database. The vulnerability is exploitable over the network with low complexity and carries a publicly available proof-of-concept. No vendor patch has been identified; the software is a free educational PHP project distributed by itsourcecode.com, limiting real-world production exposure.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate the `ID` parameter in `/pages/trans_view.php`, enabling arbitrary database read and write operations. The vulnerability is CWE-89 (Improper Neutralization of Special Elements in SQL Commands), affecting version 1.0 with no version range ambiguity per the CPE wildcard. A public exploit has been released and is available for use in attacks, raising the practical risk above the moderate CVSS 4.0 score of 5.3 suggests.