This vulnerability affects itsourcecode Sales and Inventory System version 1.0. An attacker can remotely exploit an SQL injection flaw by manipulating the User parameter in the /pages/processlogin.php script. This could allow unauthorized database queries. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed, but no official fix or patch is currently documented.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access or modification. However, the impact is rated medium due to low confidentiality, integrity, and availability impacts as per the CVSS vector. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the vulnerable functionality or applying web application firewall rules to detect and block SQL injection attempts targeting the User parameter.