The vulnerability is an SQL injection flaw in the left_cart.php file of the Online Product Reservation System, triggered by tampering with the ID argument. The flaw allows an attacker to inject arbitrary SQL statements, which can lead to unauthorized data disclosure, manipulation, or potentially further exploitation of the underlying database. This weakness falls under well‑known CWE‑89 and CWE‑74.

Affected vendors and products include code‑projects: Online Product Reservation System version 1.0. The vulnerability is tied to file app/products/left_cart.php and affects the default installation of the application. No other product or version information is provided.

The assigned CVSS score is 5.3, indicating medium severity, and the EPSS score is below 1%, suggesting a low probability of widespread exploitation at present. Attackers can exploit the flaw remotely by sending crafted HTTP requests containing malicious ID parameters. Because the flaw permits arbitrary SQL execution, an attacker can read, modify, or delete data stored in the application's database, compromising data confidentiality and integrity for the affected site. The vulnerability is not listed in the CISA KEV catalog, and no active exploits have been reported.