This vulnerability affects SourceCodester Simple POS and Inventory System 1.0. It arises from improper handling of the ID argument in the /admin/edit_customer.php script, allowing an attacker with high privileges to perform SQL injection remotely. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, but requires high privileges. The impact is limited by the requirement for high privileges and low confidentiality, integrity, and availability impact metrics. No official fix or patch has been disclosed, and no known exploits are reported.

Successful exploitation could allow an attacker with high privileges to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to the requirement of high privileges and low impact on confidentiality, integrity, and availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality to trusted users only and monitor for suspicious activity related to the /admin/edit_customer.php endpoint. Avoid exposing administrative interfaces to untrusted networks.