This vulnerability affects SourceCodester Simple POS and Inventory System 1.0. The issue is a SQL injection caused by improper sanitization of the 'Name' parameter in the /user/search.php script. An attacker can remotely exploit this flaw without any privileges or user interaction to inject malicious SQL commands. The vulnerability has been publicly disclosed, but no official fix or patch has been documented. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion. Given the medium severity score and low impact ratings on confidentiality, integrity, and availability, the impact is significant but not critical. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should monitor for vendor updates. As a temporary mitigation, restricting access to the vulnerable endpoint or employing web application firewalls with SQL injection detection rules may reduce risk. Avoid exposing the affected system to untrusted networks until a patch is available.