This vulnerability in origincode Product Catalog (<= 1.0.4) arises from improper neutralization of special elements in SQL commands within the displayproduct feature, enabling SQL Injection attacks. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) indicates that an unauthenticated attacker can remotely exploit this vulnerability with low complexity, causing a change in scope and high impact on confidentiality, no impact on integrity, and low impact on availability.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). The integrity of the data is not impacted, but availability could be slightly affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should consider applying any available workarounds from the vendor or restrict access to the vulnerable functionality if possible.