The vulnerability resides in the Sales and Inventory System version 1.0, specifically within the /pages/processlogin.php file. An attacker can manipulate the User argument to inject arbitrary SQL code. This enables unauthorized read or modification of the underlying database, potentially exposing sensitive user and inventory data. The flaw directly correlates with SQL Injection weaknesses as identified by CWE-89, and the misuse of untrusted input aligns with CWE-74.

Affected are installations of itsourcecode's Sales and Inventory System, version 1.0. Systems running this application without updates are at risk, regardless of deployment environment, as the flaw resides in a publicly accessible login endpoint.

With a CVSS score of 6.9, the risk is moderate, and the vulnerability can be exploited remotely via HTTP requests. No EPSS data is available, and it is not listed in the CISA KEV catalog, suggesting limited confirmed exploitation reports. Attackers can gain data exposure or integrity compromise by injecting SQL through the User parameter if the application fails to properly sanitize input or use parameterized queries.