This vulnerability involves an SQL injection flaw in the itsourcecode Online Cellphone System 1.0, specifically in the /cp/available.php file within the Parameter Handler component. Manipulating the 'Name' parameter allows an attacker to inject SQL commands remotely. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is publicly documented but lacks an official fix or patch at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access or modification depending on the database permissions. However, the impact is rated medium due to limited details on the extent of the affected functionality and the absence of known active exploits.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or web application firewalls to detect and block SQL injection attempts targeting the 'Name' parameter in /cp/available.php. Monitor vendor channels for updates regarding patches or official mitigations.