AojiaoZero Antaris 1.0 contains a flaw in the PayPal IPN Payment Handler’s _rewardPurchase function within ipn.php. This issue aligns with CWE-74 and CWE-89. The item_number argument is not properly validated, allowing an attacker to inject arbitrary SQL through that parameter. Because the injection can be performed remotely, an adversary could read, modify, or delete database records related to payment processing, compromising confidentiality, integrity, and availability of transaction data.

The vulnerable component is Antaris 1.0 from the vendor AojiaoZero. No additional versions are listed, indicating that the 1.0 release is the only affected product at this time.

The CVSS score of 5.3 classifies the vulnerability as moderate and indicates a very low projected exploit probability, and the issue is not listed in CISA's KEV catalog, implying no known exploitation activity. The attack vector is remote, and it is unclear whether authentication is required, as the description does not specify this. An exploit can succeed by sending a specially constructed request to /ipn.php, and the lack of parameterized queries or input filtering increases the feasibility of successful injection.