---
id: "CVE-2026-114251"
kind: "vulnerability"
aliases: ["CVE-2026-114251"]
title: "itsourcecode Sales-and-Inventory-System: SQL injection in cust_del.php via ID"
severity: "medium"
cvss: 6.5
epss: 0.00251
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "php", "self-hosted", "sql-injection"]
not_affected_if: ["does-not-run-this-app"]
published_at: "2026-10-21T15:17:17+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:49:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114251", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114251", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# itsourcecode Sales-and-Inventory-System: SQL injection in cust_del.php via ID

The itsourcecode Sales-and-Inventory-System PHP application does not properly handle the ID argument in /pages/cust_del.php, allowing SQL injection. An attacker who can reach the page can read or alter the application's database, and the exploit has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the application is deployed and whether `/pages/cust_del.php` is reachable on the server
- Review the repository's commit history for the `0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac` revision the sources name, since the project does not use versions
- unknown for a vendor-supplied test or version string

## Fix

- unknown: the sources report that the project has not responded and no fixed release is listed
- Restrict access to `/pages/cust_del.php` at the web server or network until a patch exists
- Replace the raw ID input with a parameterized query in `cust_del.php`

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114251
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114251

## From the sources

A vulnerability has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. Impacted is an unknown function of the file /pages/cust_del.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_