The itsourcecode Sales and Inventory System version 1.0 contains a SQL injection vulnerability in an unspecified function within /pages/cust_pos_trans.php. An attacker can manipulate the 'firstname' parameter to execute arbitrary SQL commands remotely. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity, with low attack complexity and no user interaction required. Exploit code has been publicly released, increasing the risk of exploitation. No official fix or patch information is available from the vendor or advisory.

Successful exploitation of this vulnerability allows an attacker with low privileges to execute arbitrary SQL commands on the backend database remotely. This can lead to unauthorized data access, modification, or deletion. The vulnerability's medium severity reflects the potential for data compromise but does not indicate immediate critical system takeover or widespread impact. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the vulnerable endpoint and applying input validation or web application firewall rules to mitigate SQL injection attempts targeting the 'firstname' parameter.