The Tailor Management System 1.0 contains an unsanitized 'id' parameter in customeredit.php, allowing an attacker to inject arbitrary SQL statements. This flaw can be exploited to read, modify, or delete data from the underlying database, thereby compromising the confidentiality and integrity of customer records. Based on the description, it is inferred that the attack vector is remote via an HTTP request to the web interface, where the attacker supplies a crafted 'id' value.

SourceCodester Tailor Management System version 1.0 is affected. No other versions are currently known to be vulnerable.

The vulnerability can be exploited by crafting a malicious value for the 'id' parameter in the URL of the customeredit.php page, which is accessible to anyone who can request the page. The CVSS score is 9.8 and the EPSS score is less than 1%; the flaw is not listed in the CISA KEV catalog. These metrics indicate a high overall risk, with exploitation currently regarded as unlikely, but the ability to directly manipulate the database remains severe.