This vulnerability affects itsourcecode Sales and Inventory System version 1.0. An attacker can manipulate the ID parameter in the /pages/us_edit1.php file to perform SQL injection attacks remotely. The CVSS 4.0 base score is 5.3 (medium), indicating that the attack vector is network-based with low attack complexity and no privileges or user interaction required. The vulnerability has been publicly disclosed, but no vendor-provided fix or mitigation details are currently available.

Successful exploitation allows an attacker to execute arbitrary SQL commands on the backend database via the vulnerable ID parameter. This can lead to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication or user interaction, increasing the risk of compromise. However, the overall impact is rated medium due to limited complexity and scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint, applying web application firewall rules to detect and block SQL injection attempts, and monitoring for suspicious activity related to the ID parameter. Avoid relying on generic mitigations unless specifically tailored to this vulnerability.