An unauthenticated SQL injection vulnerability in the itsourcecode Inventory Management System allows remote attackers to compromise database integrity and potentially access sensitive information.

This is a SQL injection vulnerability (CWE-89) located in the file /admin/user/index.php within the edit view. An unauthenticated attacker can exploit this by injecting malicious SQL commands into the ID argument.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to the underlying database, potentially resulting in the exfiltration of user credentials or administrative data. With a CVSS score of 7.3, this flaw poses a high risk to organizational data confidentiality and integrity. If the database user has elevated privileges, the impact could extend to full system compromise or unauthorized administrative actions.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin directory using network-level controls or IP allowlisting.

Proactive Monitoring: Monitor server access logs for suspicious HTTP requests targeting the /admin/user/index.php endpoint, specifically looking for unusual patterns in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the identified vulnerable endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked GitHub repository.

Given the availability of a public proof-of-concept, the risk of exploitation is elevated. Organizations currently running the affected version of the Inventory Management System should prioritize restricting access to the administrative interface immediately and monitor for unauthorized activity until a permanent vendor patch is released.