This vulnerability exists in Bdtask Multi-Store Inventory Management System 1.0 within the accounts_report_search function of application/modules/accounts/controllers/Accounts.php. Manipulating the dtpToDate parameter enables an attacker to inject SQL commands remotely, potentially compromising the database. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. No official fix or patch has been published as of the data provided.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access, modification, or other database impacts depending on the injected payload. However, the vulnerability has low confidentiality, integrity, and availability impact metrics, suggesting limited but non-negligible risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation or parameterized queries as a temporary mitigation if possible. Monitor for updates from Bdtask regarding patches or official remediation instructions.