This vulnerability is an SQL injection that occurs when user supplied input to the item search GET parameter is placed directly into an HAVING clause without parameterization or sanitization. An attacker with valid item search permissions can inject arbitrary SQL commands, which can lead to disclosure of confidential data or modification of inventory records, impacting the integrity and confidentiality of the database.

The flaw exists in the Open Source Point of Sale application, a PHP web application built on the CodeIgniter framework. All releases that include the Items search functionality with the custom attribute search feature are affected. No specific version ranges are provided in the advisory.

The CVSS score of 8.8 signifies a high severity, while the EPSS score of less than 1% indicates a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated with permissions to perform item searches and to use the search_custom filter. The likely attack vector is web-based input manipulation through the search interface.