The vulnerability is a classic SQL injection flaw that targets the customer_name and category parameters in the file /Invoicing/IGST_Invoice.php. Attackers can embed arbitrary SQL statements in these inputs, allowing them to read, modify, or delete data stored in the database. The flaw is identified as CWE‑89. The CVSS score of 5.3 indicates a moderate severity, meaning the impact is significant enough to potentially compromise data integrity and confidentiality when it is successfully exploited.

The affected product is SourceCodester Indian Invoicing System version 1.0. The vulnerability resides in its Invoice Generation Handler component, specifically within IGST_Invoice.php. No other versions or components are currently reported to be impacted.

The attack can be launched remotely and an exploit has been published publicly, indicating that threat actors may attempt to exploit it today. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of mitigation and the existence of a public exploit suggest a non‑negligible likelihood of real‑world attacks. No known patch is available in the provided data, so the primary risk depends on the organization’s current exposure and defensive posture.