A software flaw in the 1.0 release of code‑projects Online Product Reservation System permits an attacker to supply crafted id and qty values to the /app/checkout/update.php handler, leading to a SQL injection vulnerability (CWE‑74 and CWE‑89). Because the input is not properly validated before being incorporated into SQL statements, an attacker can execute arbitrary database commands, potentially exposing order details or altering stored records and compromising confidentiality or integrity of transaction data.

The affected product is code‑projects Online Product Reservation System version 1.0. Systems that expose the /app/checkout/update.php endpoint as part of the cart update handler are at risk. Administrators should verify whether their deployments are using this exact version and whether the vulnerable file is publicly accessible.

The reported CVSS score of 5.3 indicates moderate severity. The EPSS rating shows that the likelihood of exploitation is low (less than 1%) and the issue is not listed in CISA’s KEV catalog. The vulnerability can be triggered remotely by an external actor through HTTP requests to the vulnerable endpoint. Public proof‑of‑concept code is available, suggesting that an attacker could exploit the flaw from outside the network without elevated credentials.