The flaw resides in the customer delete page (/pages/cust_del.php) of itsourcecode Sales‑and‑Inventory‑System. An attacker can supply a crafted "ID" query parameter, which the application concatenates directly into an SQL statement. This results in a classic SQL injection under CWE-74 and CWE-89, enabling arbitrary SQL execution that can delete or modify customer records, corrupt the database, or expose confidential information. The vulnerability is exploitable remotely via HTTP requests to the vulnerable page.

All instantiations of itsourcecode Sales‑and‑Inventory‑System built before the commit 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac are affected. Because the project does not use semantic versioning, the precise affected releases cannot be enumerated; any build prior to that commit remains vulnerable.

The CVSS score of 5.3 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The description states the attack can be launched remotely by crafting HTTP requests, but it does not specify whether authentication is required, so the exploitability for unauthenticated users remains uncertain.