The flaw resides in the User Registration Handler script register_code.php of Online Product Reservation System 1.0. By carefully crafting values for the fields fname, lname, address, city, province, country, zip, tel_no, email, and username, an attacker can inject arbitrary SQL into the backend. The vulnerability is a classic SQL injection, matching CWE‑74 and CWE‑89. Successful exploitation would give the attacker read, modify or delete privileges in the database, undermining confidentiality, integrity, and potentially availability of the reservation system.

Affected systems are primarily the code‑projects Online Product Reservation System version 1.0. No other versions or components were noted in the CNA data.

According to the CVSS score of 6.9, the vulnerability provides moderate to high impact. The EPSS score of less than 1% indicates low, but not negligible, likelihood of exploitation under current conditions. The vulnerability is not yet listed in the CISA KEV catalog, yet public proof‑of‑concept code is available, so the attack can be initiated remotely with minimal prerequisites. The attack path simply involves submitting manipulated form data to the registration endpoint, which is reachable from the Internet.