Itsourcecode Sales and Inventory System: Five SQLi Flaws Disclosed Together
A batch of five medium-severity SQL injection vulnerabilities in Itsourcecode Sales and Inventory System 1.0 were disclosed between September 13-14, 2026, with exploits publicly available.
Key findings
- Five SQL injection vulnerabilities disclosed together for Itsourcecode Sales and Inventory System 1.0.
- All vulnerabilities carry a Medium severity rating (CVSSv3 6.3) and allow remote exploitation.
- Flaws are present in multiple PHP files related to data editing and transactions.
- Exploits for all CVEs have been publicly disclosed and may be in use.
- No specific patches or advisories have been released by the vendor yet.
On September 13-14, 2026, a batch of five SQL injection vulnerabilities was disclosed for the Itsourcecode Sales and Inventory System version 1.0. All vulnerabilities were reported on the same day or within a 19-hour window, indicating a coordinated disclosure event. These flaws, all rated as Medium severity with a CVSSv3 score of 6.3, allow remote attackers to inject malicious SQL code into the system.
The vulnerabilities are concentrated in specific PHP files responsible for data editing and transaction processing:
- CVE-2026-90700 affects /pages/pro_edit1.php, allowing SQL injection via manipulation of the 'prodcode' argument.
- CVE-2026-90600 impacts /pages/inv_edit1.php, with SQL injection possible through the 'ID' argument.
- CVE-2026-90597 targets /pages/sup_edit1.php, where manipulation of the 'ID' argument leads to SQL injection.
- CVE-2026-90574 is found in /pages/emp_transac.php, with SQL injection occurring via the 'firstname' argument when the action is 'add'.
- CVE-2026-90525 impacts /pages/cust_pos_trans.php, where manipulation of the 'firstname' argument can result in SQL injection.
All five reported vulnerabilities have been publicly disclosed and are potentially exploitable. The consistent nature of these SQL injection flaws across different administrative and transactional pages suggests a systemic weakness in how the Sales and Inventory System handles user input.
The vendor, Itsourcecode, has not yet released specific patches or advisories for these vulnerabilities. Users are advised to monitor the vendor's official channels for updates. Given that all disclosed vulnerabilities affect version 1.0, upgrading to a newer, patched version, if available, would be the most effective mitigation.
The coordinated disclosure of these five SQL injection vulnerabilities highlights a significant risk for organizations using the Itsourcecode Sales and Inventory System 1.0. The public availability of exploit details means that systems remain vulnerable until patched. Users should prioritize understanding their exposure and preparing for vendor updates.