This vulnerability is a reflected cross-site scripting (XSS) issue in the Indian Invoicing System by SourceCodester, affecting versions 0.* and 1.0. The flaw arises from improper sanitization or validation of the customer_name argument in the add_order.php script, allowing remote attackers to inject and execute arbitrary scripts in the context of the affected application. The vulnerability does not require user interaction beyond triggering the crafted request and has no associated privileges or scope changes. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, partial user interaction, and limited impact on confidentiality and integrity.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side impacts. However, the impact is limited to the client side and does not directly compromise server confidentiality, integrity, or availability. There are no reports of active exploitation in the wild.

No official patch or remediation has been published by the vendor. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying input validation or output encoding on the customer_name parameter to mitigate XSS risks. Monitoring for suspicious activity related to this parameter is advisable. Avoid relying on generic mitigations unless they specifically address this vulnerability.