A flaw was discovered in the itsourcecode sanitize or validate this input 1.0 component that handles /borrowedequip.php. The flaw resides in the emp_id parameter, which can be manipulated to inject arbitrary SQL statements into the database query. Attackers able to supply malicious content can execute arbitrary SELECT, UPDATE, DELETE, or INSERT commands, potentially exposing sensitive data, altering inventory records, or disrupting operations. The vulnerability stems from improper input sanitization (CWE‑74) and improper neutralization of special elements used in an SQL command (CWE‑89).

The affected product is itsourcecode sanitize or validate this input version 1.0, specifically the borrowedequip.php file within the Parameter Handler module. Administrators deploying this component should verify whether their installations include this vulnerable code. No vendor patch or specific affected version range is published, so users should check for updates or vendor advisories.

The CVSS v3.1 score of 5.3 indicates moderate severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack is feasible remotely, as the vulnerability is triggered by manipulating a user-controllable parameter sent via HTTP. Published exploits suggest that attackers can already exploit the issue, raising the likelihood of real-world impact. Until a vendor fix is released, the risk remains moderate to high depending on the application's role in handling confidential data.