This vulnerability affects SourceCodester Indian Invoicing System 1.0 and arises from improper handling of input parameters customer_name and category in the /Invoicing/IGST_Invoice.php file. An attacker can remotely manipulate these parameters to perform SQL injection, potentially compromising the backend database. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No official fix or patch has been published by the vendor, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The medium severity score reflects limited impact due to low privileges required and limited scope of the vulnerability. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should consider implementing input validation or web application firewall (WAF) rules to block malicious input targeting the customer_name and category parameters. Monitor vendor channels for updates regarding an official fix.