{"id":"CVE-2026-114251","kind":"vulnerability","aliases":["CVE-2026-114251"],"related":[],"title":"itsourcecode Sales-and-Inventory-System: SQL injection in cust_del.php via ID","description":"A vulnerability has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. Impacted is an unknown function of the file /pages/cust_del.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The itsourcecode Sales-and-Inventory-System PHP application does not properly handle the ID argument in /pages/cust_del.php, allowing SQL injection. An attacker who can reach the page can read or alter the application's database, and the exploit has been published.","severity":"medium","cvss":6.5,"epss":0.00251,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","php","self-hosted","sql-injection"],"not_affected_if":["does-not-run-this-app"],"how_to_check":"- Check whether the application is deployed and whether `/pages/cust_del.php` is reachable on the server\n- Review the repository's commit history for the `0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac` revision the sources name, since the project does not use versions\n- unknown for a vendor-supplied test or version string","fix":"- unknown: the sources report that the project has not responded and no fixed release is listed\n- Restrict access to `/pages/cust_del.php` at the web server or network until a patch exists\n- Replace the raw ID input with a parameterized query in `cust_del.php`","status":"open","published_at":"2026-10-21T15:17:17+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:49:01+00:00","updated_at":"2026-10-25T03:49:01+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:49:01Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources report that the project has not responded and no fixed release is listed\n- Restrict access to `/pages/cust_del.php` at the web server or network until a patch exists\n- Replace the raw ID input with a parameterized query in `cust_del.php`","reach":"internet","title":"itsourcecode Sales-and-Inventory-System: SQL injection in cust_del.php via ID","impact":"medium","summary":"The itsourcecode Sales-and-Inventory-System PHP application does not properly handle the ID argument in /pages/cust_del.php, allowing SQL injection. An attacker who can reach the page can read or alter the application's database, and the exploit has been published.","category":"other","nicknames":[],"who_cares":["php","self-hosted","sql-injection"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or changes the sales and inventory database remotely","analyst_note":"Confirm whether a fixed version or a vendor response exists and whether authentication is required to reach cust_del.php, using the NVD entry linked in the sources.","how_to_check":"- Check whether the application is deployed and whether `/pages/cust_del.php` is reachable on the server\n- Review the repository's commit history for the `0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac` revision the sources name, since the project does not use versions\n- unknown for a vendor-supplied test or version string","needs_analyst":true,"not_affected_if":["does-not-run-this-app"],"who_is_affected":"Any deployment of the itsourcecode Sales-and-Inventory-System up to the named commit that exposes the cust_del.php page is affected, since the flaw is in how that page passes the ID argument into SQL. Teams that do not run this application can skip it. Whether a login is needed to reach the page is not stated in the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":3468,"output_tokens":677,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114251':15A,18A '-2026':14A,17A '/pages/cust_del.php':44B,92C '0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac':83C 'affect':132C 'allow':45B 'alter':58B 'applic':35B,60B 'argument':42B,97C 'attack':49B,104C 'cust_del.php':10A 'cve':13A,16A 'databas':62B 'disclos':113C 'earli':145C 'exploit':65B,110C 'file':91C 'found':73C 'function':88C 'handl':39B 'host':23B 'id':12A,41B,98C 'impact':84C 'inform':130C,141C 'inject':8A,26B,47B,102C 'inventori':5A,32B,79C 'issu':148C 'itsourcecod':1A,28B,75C 'launch':107C 'lead':99C 'manipul':94C 'may':118C 'page':54B 'php':20B,34B 'problem':144C 'product':122C 'project':139C 'proper':38B 'public':116C 'publish':68B 'reach':52B 'read':56B 'releas':135C 'remot':108C 'report':149C 'respond':153C 'sale':3A,30B,77C 'sales-and-inventory-system':2A,29B,76C 'self':22B 'self-host':21B 'sql':7A,25B,46B,101C 'sql-inject':24B 'system':6A,33B,80C 'unaffect':134C 'unavail':137C 'unknown':87C 'use':120C,125C 'version':126C 'via':11A 'vulner':70C 'yet':154C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of the itsourcecode Sales-and-Inventory-System up to the named commit that exposes the cust_del.php page is affected, since the flaw is in how that page passes the ID argument into SQL. Teams that do not run this application can skip it. Whether a login is needed to reach the page is not stated in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T15:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114251","severity":null,"published_at":"2026-10-21T15:17:17+00:00","modified_at":"2026-10-21T18:19:16+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114251","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114251","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}