Tailor Management System 1.0 exposes a web script that accepts a numeric identifier through an HTTP GET parameter without sanitization, enabling attackers to inject arbitrary SQL code. This flaw can be leveraged to read, modify, or delete database contents, potentially compromising customer records, financial data, and operational integrity of the apparel management operation. The vulnerability fails to authenticate or validate input, making it a classic SQL Injection of type CWE‑89.

The affected product is SourceCodester Tailor Management System, version 1.0. No other vendor or product versions are listed for this vulnerability. If the system is deployed on a web server accessible to unauthorized users, any susceptible user could target the addmeasurement.php endpoint.

The flaw is remotely exploitable via a crafted HTTP request to addmeasurement.php?id=… and would not require local privileges. The CVSS score of 9.8 highlights a high severity, and an EPSS score of <1% indicates a low but non‑zero exploitation probability. The lack of built‑in input filtering implies a potentially high exploitation likelihood for exposed web interfaces. The vulnerability is not recorded in the CISA KEV catalog, indicating no confirmed national exploitation at the time of this analysis. Attackers could achieve unauthorized data disclosure or manipulation if the system is exposed to the internet.