CVE-2026-78171: itsourcecode Sales and Inventory System processlogin.php sql injection
A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/processlogin.php. The manipulation of the argument User leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The attack can be initiated remotely and does not require privileges or user interaction. An attacker able to reach the affected login endpoint can target the User argument.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used, which increases the likelihood of opportunistic exploitation.
What should be prioritized for triage?
Identify deployments of itsourcecode Sales and Inventory System 1.0 that expose /pages/processlogin.php to remote users. Review requests to that endpoint for suspicious SQL injection payloads in the User parameter.