The vulnerability resides in the Sales and Inventory System 1.0 in the file /pages/cust_transac.php on the action "add". Manipulating the firstname argument allows an attacker to inject arbitrary SQL code. This can lead to unauthorized data disclosure, modification, or deletion, compromising the confidentiality and integrity of the system’s database. The attack is executable remotely and the exploit is publicly available.

The affected product is itsourcecode Sales and Inventory System, version 1.0. The specific code path is the cust_transac.php script, which processes new customer transaction submissions via the action parameter.

The CVSS score of 5.3 indicates a moderate severity vulnerability. EPSS is not provided, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no large-scale exploitation has been observed yet. The likely attack vector is an external HTTP request to the add action with a crafted firstname parameter, and no authentication is implied in the description. Thus, the risk is moderate but should be addressed promptly to prevent potential data compromise.