The vulnerability is a SQL injection flaw in the trans_view.php component of itsourcecode Sales and Inventory System. Manipulating the ID request argument allows an attacker to inject arbitrary SQL commands, which can reveal sensitive data, modify existing records, or execute destructive operations. This weakness is reflected in CWE-74 and CWE-89 and can be leveraged remotely, enabling attackers to compromise data confidentiality, integrity, and potentially availability.

itsourcecode Sales and Inventory System version 1.0 is affected. The flaw exists within the trans_view.php file used by the web application. No other product versions are listed as impacted.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, making it hard to gauge current exploitation likelihood. The vulnerability is not yet in CISA KEV. The typical attack path involves a remote user sending a crafted ID parameter to trans_view.php over HTTP, which the application then passes directly into an SQL statement. Exploitation can occur without authentication if the page is publicly reachable, but stronger access controls could reduce risk.