The vulnerability allows a remote attacker to inject arbitrary web scripts or HTML into the page returned by add_customer.php. By exploiting the unsanitized "msg" query parameter, an attacker can deliver malicious code that executes in the browsers of any user who clicks the crafted URL. This cross‑site scripting can lead to theft of user credentials, session hijacking, or defacement of the website's pages. The weakness is associated with improper neutralization of input during web page generation.

SourceCodester Sales and Inventory System 1.0 is impacted. Users running this 1.0 installation are susceptible when they allow the "msg" parameter to be processed without sanitization.

The exploit requires only the ability to construct a URL containing malicious payloads in the "msg" parameter, making it a publicly exploitable reflected XSS. No CVSS score or EPSS information is available, and the vulnerability is not listed in the CISA KEV catalog. Consequently, its risk is considered moderate: any user who follows a malicious link could be affected, but the attack is limited to the client side and can be mitigated with proper input handling. The likely attack vector is a simple HTTP GET request to the vulnerable endpoint.