A flaw in the Grocery Store Management System 1.0 allows attackers to inject arbitrary SQL through the sitem_name POST parameter sent to /Grocery/search_products_itname.php. The unvalidated input can bypass database filtering, enabling attackers to read, modify, or delete data in the underlying database. This weakness corresponds to the classic SQL Injection vulnerability (CWE-89) and can lead to confidentiality and integrity compromises for the application's data.

The affected product is the Grocery Store Management System 1.0 developed by anirudhkannan. The vulnerability exists in the /Grocery/search_products_itname.php component, which processes POST requests from users searching for products by name.

The CVSS score of 9.8 indicates a critical level of risk, with a high likelihood that attackers can exploit this flaw remotely by sending crafted POST requests to the vulnerable endpoint. The lack of available EPSS data means the exploit probability is not quantified, but the absence of a KEV listing does not reduce the potential for abuse. Given that the input parameter is accessible without special permissions, the vulnerability can be leveraged by unauthenticated users to extract or manipulate database contents.