This vulnerability affects Bdtask Multi-Store Inventory Management System 1.0 specifically in the accounts_report_search function of application/modules/accounts/controllers/Accounts.php. An attacker can manipulate the dtpToDate parameter to inject SQL commands, potentially compromising the database. The vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 base score of 5.1, indicating medium severity. No official fix or patch has been published by the vendor as of the information available.

Successful exploitation of this SQL injection vulnerability could allow an attacker with high privileges to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or disruption of the inventory management system's database integrity. However, the impact is rated medium due to the requirement of high privileges and limited scope of the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected function and validate or sanitize input parameters such as dtpToDate to mitigate injection risks. Monitor vendor channels for updates regarding patches or official mitigations.