CVE-2026-90597: itsourcecode Sales and Inventory System sup_edit1.php sql injection
A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/supedit1.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker with low privileges can exploit the SQL injection; no user interaction is required. The vulnerable request targets the ID argument in /pages/sup_edit1.php.
Is there public exploit information?
Yes. The exploit has been publicly disclosed and may be used, increasing the likelihood of attempted exploitation.
How can I determine whether my deployment is affected?
Confirm whether you run itsourcecode Sales and Inventory System version 1.0 and whether /pages/sup_edit1.php is present and accepts an ID parameter. The available data does not identify a fixed version or workaround.