The Online Product Reservation System version 1.0 contains a flaw in the delete.php page where the ID argument is not properly sanitized. Attackers can inject malicious SQL through this parameter, resulting in unauthorized deletion or modification of reservation records and potentially exposing sensitive data. The vulnerability is classified as a SQL injection (CWE‑74 and CWE‑89) that can be exploited remotely.

The affected vendor is code‑projects, and the product impacted is the Online Product Reservation System, specifically version 1.0. The vulnerability resides in the /handgunner‑administrator/delete.php endpoint used by the system’s administrative interface.

The CVSS score of 6.9 indicates a moderate severity with potential for data loss. The EPSS score of less than 1% suggests a low current exploitation probability, but the issue is publicly disclosed and can be leveraged by remote attackers. Although the vulnerability is not listed in the CISA KEV catalog, the attack vector is remote and relies on manipulating an HTTP GET or POST parameter, meaning any user with access to the web interface could trigger it.