A flaw in the Sales and Inventory System allows an attacker to manipulate the Name parameter in the pro_transac.php add action to inject arbitrary SQL. This results in unauthorized database reads or writes, potentially exposing sensitive business data or altering inventory records. The vulnerability is a classic input validation weakness as defined by CWE-74 and the resultant SQL injection is a CWE-89 style flaw, permitting an attacker to dictate query structure while bypassing intended logic.

The issue impacts itsourcecode’s Sales and Inventory System, specifically version 1.0. The vulnerable component is the /pages/pro_transac.php script when the action query‐string is set to add. All installations using that version are affected; no later releases are documented as mitigating the flaw.

The reported CVSS score of 5.3 places the vulnerability in the medium severity range. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower current exploitation probability. The attack can be launched remotely, as the description notes that the payload can be delivered over the network. Exploitation requires only the ability to target the specific page and supply a malicious Name value, so a publicly accessible instance is a high‑risk target. In the absence of a known public exploit, the likelihood of immediate use is moderate yet non‑negligible.