A flaw exists in itsourcecode’s Sales and Inventory System that allows arbitrary SQL statements to be executed when a malicious value is supplied for the Customer argument in the pos_transac.php script. The injected SQL can read, modify, or delete data stored in the database, potentially exposing sensitive business information or corrupting inventory records. The weakness is identified as CWE‑74 (Improper neutralization of file name after external control) and CWE‑89 (SQL Injection).

The vulnerability targets version 1.0 of itsourcecode’s Sales and Inventory System, specifically the pos_transac.php file with the action=add parameter. No other product versions or components are listed as affected.

The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available, leaving the exploitation likelihood uncertain, but the presence of a published exploit and the remote nature of the attack suggest risk higher than the base score might imply. The vulnerability is not listed in the CISA KEV catalog. The exploit can be triggered by sending a crafted request to the public URL that includes the vulnerable Customer parameter; based on the description, no authentication requirement is mentioned, so it is inferred that attackers may not need credentials to trigger the vulnerability, though this is not explicitly confirmed.