The vulnerability exists in the order_by function of the DB_query_builder.php component in amirsanni Mini-Inventory-and-Sales-Management-System up to commit 81bf0b55f5933f3b0dbb1583204a612e06605b95. Manipulating the orderBy argument leads to SQL injection, enabling remote exploitation. The project maintainer has ceased maintenance and does not plan to fix the issue. No affected versions or patches are provided due to the rolling release model and discontinued support.

Successful exploitation allows remote attackers to perform SQL injection attacks via the orderBy parameter, potentially leading to unauthorized data access or manipulation. However, the vulnerability is limited to unsupported versions of the product, which reduces the likelihood of active exploitation in maintained environments.

No official fix or patch is available as the project is no longer maintained. Users should consider discontinuing use of this software or migrating to a supported alternative. Applying additional protective measures such as web application firewalls to detect and block SQL injection attempts may help mitigate risk.