This vulnerability involves SQL injection in the itsourcecode Online Cellphone System 1.0, specifically in the /cp/available.php file's Parameter Handler component. An attacker can remotely manipulate the 'Name' parameter to inject SQL commands, potentially compromising the backend database. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low complexity, no user interaction, and limited scope and impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and no known active exploitation has been observed.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is limited as indicated by the CVSS vector, with low confidentiality, integrity, and availability impacts. No evidence of active exploitation in the wild is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected component and validate or sanitize input parameters to mitigate injection risks. Monitor vendor channels for updates and apply patches promptly once available.