Itsourcecode Sales and Inventory System: Four SQLi Flaws Disclosed Together
Key findings • Four SQL injection vulnerabilities disclosed together for Itsourcecode Sales and Inventory System 1.0. • All vulnerabilities affect version 1.0 and are triggered by manipulatin…
Key findings
- Four SQL injection vulnerabilities disclosed together for Itsourcecode Sales and Inventory System 1.0.
- All vulnerabilities affect version 1.0 and are triggered by manipulating the 'ID' argument.
- Publicly available exploits exist for all disclosed CVEs.
- The vulnerabilities are spread across multiple PHP files including pro_edit.php, emp_searchfrm.php, emp_del.php, and emp_edit.php.
On August 29-30, 2026, a batch of four medium-severity SQL injection vulnerabilities was disclosed for the Itsourcecode Sales and Inventory System version 1.0. These vulnerabilities, all stemming from the manipulation of the 'ID' argument in various PHP files, allow for remote attacks and have publicly available exploits.
The vulnerabilities are concentrated in specific files within the system:
/pages/pro_edit.php(CVE-2026-82485)/pages/emp_searchfrm.php(CVE-2026-82484)/pages/emp_del.php(CVE-2026-82422)/pages/emp_edit.php(CVE-2026-82421)
All four CVEs share the same attack vector: SQL injection via manipulation of the 'ID' parameter. The descriptions indicate that the exploits have been publicly disclosed and may be used for attacks. The consistent nature of these vulnerabilities suggests a common underlying coding error in how the 'ID' argument is handled across different modules of the Sales and Inventory System.
As of the disclosure, the Itsourcecode Sales and Inventory System version 1.0 is affected. No specific patch information or updated version numbers were provided in the disclosure details. Users are advised to consult Itsourcecode's official security advisories for any available mitigation or remediation steps.
The coordinated disclosure of these four SQL injection flaws within a 12-hour window highlights a significant security concern for users of the Itsourcecode Sales and Inventory System 1.0. The availability of public exploits for these medium-severity issues necessitates prompt attention from administrators to secure their installations against potential remote attacks.