A vulnerability exists in the Online Product Reservation System 1.0 where unsanitized POST parameters prod_id, name, price, model, and serial are incorporated directly into SQL statements within edit.php. This flaw allows an attacker to inject arbitrary SQL and therefore read, modify, or delete arbitrary data in the database. The impact could lead to credential theft, product inventory manipulation, or broader system compromise if database connection has elevated privileges, potentially enabling further attacks.

The affected product is the Online Product Reservation System released by code-projects, version 1.0. The flaw resides in the administration interface edit.php used by authorized users to modify product details.

With a CVSS score of 6.9, the vulnerability carries a medium‑to‑high risk. The EPSS score of less than 1% indicates a low likelihood of active exploitation, and the vulnerability is not currently catalogued in the CISA KEV list. The attack can be launched remotely by a user who can send crafted POST requests to the vulnerable endpoint, a fact that we infer from the description which mentions remote launch but does not specify authentication requirements. The underlying weaknesses are identified as CWE‑74 (Improper Neutralization of Input) and CWE‑89 (SQL Injection). Given the remote nature of the attack vector and the severe potential for data exfiltration or modification, immediate mitigation is warranted.