This vulnerability resides in the admin/productcontroller.php component of the Agri‑Trading Online Shopping System. By sending a specially crafted POST request that manipulates the Product parameter, an attacker can inject arbitrary SQL commands into the database. The exploit is accessible from outside the network and has been made public, meaning that an unauthenticated user can gain unauthorized read or write access to the database, potentially exposing sensitive user data or modifying transaction records.

The affected product is itsourcecode Agri‑Trading Online Shopping System, version 1.0, as identified by the vendor and CPE string cpe:2.3:a:adonesevangelista:agri-trading_online_shopping_system:1.0. No other versions or products are listed as vulnerable in the provided data.

The CVSS v3.1 score of 6.9 indicates medium to high severity, but the EPSS score of less than 1% suggests a low probability of real‑world exploitation at present. The vulnerability is not listed in the CISA KEV catalog, and the attack vector is remote. The public nature of the exploit further raises the risk that skilled adversaries could target the system for data compromise or tampering.