This vulnerability arises from unsanitized input handling in the prod.php component of the Online Product Reservation System. By manipulating the cat, price, name, model, or serial arguments, an attacker can inject arbitrary SQL statements. The flaw can lead to unauthorized data extraction, modification, or deletion, thereby compromising the confidentiality, integrity, and availability of the underlying database.

The affected system is the code-projects Online Product Reservation System version 1.0. No other software versions or product lines were listed in the CNA data.

The CVSS score of 6.9 indicates a medium severity vulnerability, and the EPSS score of less than 1% suggests a low exploit probability at the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Remote exploitation is possible, as indicated by the CNA description, meaning that an attacker could reach the vulnerable endpoint over the network. The likelihood of attack remains modest, but the impact is substantial if the flaw is leveraged.