This vulnerability in SourceCodester Indian Invoicing System 1.0 allows remote attackers to conduct SQL injection attacks by manipulating the customer_name or category parameters in the /Invoicing/IGST_Invoice.php script. The flaw is due to insufficient input validation or sanitization in the Invoice Generation Handler component. The CVSS 4.0 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability could potentially allow unauthorized database queries or data manipulation. No official fix or patch has been disclosed, and the vendor has not provided remediation details.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication or user interaction, increasing the risk of attack. However, the impact is rated medium severity due to limited complexity and partial impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and sanitization on the affected parameters as a temporary mitigation. Monitoring for unusual database queries or activity related to the vulnerable endpoint may help detect exploitation attempts.