{"id":"CVE-2026-114252","kind":"vulnerability","aliases":["CVE-2026-114252"],"related":[],"title":"itsourcecode Sales-and-Inventory-System: SQL injection via cust_searchfrm.php ID parameter","description":"A vulnerability was found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. The affected element is an unknown function of the file /pages/cust_searchfrm.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.","summary":"An unauthenticated remote attacker can inject SQL through the ID argument of /pages/cust_searchfrm.php in itsourcecode's Sales-and-Inventory-System. Successful injection can expose or alter the database contents, and a public exploit exists.","severity":"medium","cvss":6.5,"epss":0.002,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","php","self-hosted","sql-injection"],"not_affected_if":["not-internet-exposed","not-using-this-project"],"how_to_check":"- Look for the file `pages/cust_searchfrm.php` in the deployed application and check whether the `ID` parameter is passed unescaped into a SQL query\n- unknown for version checks: the project uses a rolling release and the sources give no fixed version","fix":"- unknown: no patched version or vendor response is documented; the project has not responded to the report\n- Restrict access to the application or remove the `pages/cust_searchfrm.php` endpoint until a fix is confirmed\n- Parameterize the `ID` query in that file if you maintain the code","status":"open","published_at":"2026-10-21T15:17:17+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:49:01+00:00","updated_at":"2026-10-25T03:49:01+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:49:01Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: no patched version or vendor response is documented; the project has not responded to the report\n- Restrict access to the application or remove the `pages/cust_searchfrm.php` endpoint until a fix is confirmed\n- Parameterize the `ID` query in that file if you maintain the code","reach":"internet","title":"itsourcecode Sales-and-Inventory-System: SQL injection via cust_searchfrm.php ID parameter","impact":"high","summary":"An unauthenticated remote attacker can inject SQL through the ID argument of /pages/cust_searchfrm.php in itsourcecode's Sales-and-Inventory-System. Successful injection can expose or alter the database contents, and a public exploit exists.","category":"other","nicknames":[],"who_cares":["php","self-hosted","sql-injection"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or modifies the sales and inventory database remotely","analyst_note":"Confirm whether the endpoint requires login and whether any fixed commit exists in the itsourcecode project repository.","how_to_check":"- Look for the file `pages/cust_searchfrm.php` in the deployed application and check whether the `ID` parameter is passed unescaped into a SQL query\n- unknown for version checks: the project uses a rolling release and the sources give no fixed version","needs_analyst":true,"not_affected_if":["not-internet-exposed","not-using-this-project"],"who_is_affected":"Teams running itsourcecode Sales-and-Inventory-System up to commit 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac, reachable over the network. Installations not exposed to the internet, or that do not use this project, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000667,"input_tokens":3478,"output_tokens":639,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114252':15A,18A '-2026':14A,17A '/pages/cust_searchfrm.php':39B,86C '0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac':75C 'affect':77C,132C 'alter':53B 'argument':37B,92C 'attack':30B,99C 'avail':138C 'content':56B 'continu':123C 'could':111C 'cust_searchfrm.php':10A 'cve':13A,16A 'databas':55B 'deliv':122C 'earli':146C 'element':78C 'exist':61B 'exploit':60B,105C 'expos':51B 'file':85C 'found':65C 'function':82C 'host':23B 'id':11A,36B,93C 'inform':130C,142C 'initi':102C 'inject':8A,26B,32B,49B,97C 'inventori':5A,46B,71C 'issu':149C 'itsourcecod':1A,41B,67C 'made':108C 'manipul':89C 'may':100C 'model':120C 'paramet':12A 'perform':87C 'php':20B 'problem':145C 'product':115C 'project':140C 'public':59B,109C 'releas':119C,135C 'remot':29B,103C 'report':150C 'respond':154C 'result':94C,127C 'roll':118C 'sale':3A,44B,69C 'sales-and-inventory-system':2A,43B,68C 'self':22B 'self-host':21B 'specif':128C 'sql':7A,25B,33B,96C 'sql-inject':24B 'success':48B 'system':6A,47B,72C 'unauthent':28B 'unknown':81C 'updat':124C,134C 'use':113C,116C 'version':129C 'via':9A 'vulner':63C 'yet':155C","nicknames":[],"mitigations":[],"who_affected":"Teams running itsourcecode Sales-and-Inventory-System up to commit 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac, reachable over the network. Installations not exposed to the internet, or that do not use this project, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T15:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114252","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114252","severity":null,"published_at":"2026-10-21T15:17:17+00:00","modified_at":"2026-10-21T18:19:16+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114252","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114252","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}