SourceCodester Water Billing Management System 1.0 contains an SQL injection flaw in the user management module where the ID argument of the /admin/?page=user/manage_user endpoint is not properly sanitized. This flaw allows an attacker to inject arbitrary SQL statements, potentially compromising data confidentiality, integrity, or availability. The vulnerability maps to CWE-74 for unsanitized input handling and CWE-89 for plain SQL query misuse.

The affected product is SourceCodester Water Billing Management System 1.0, specifically the admin user management component that processes the ID parameter in the manage_user page. Any deployment of this version that still uses the default, unpatched code is vulnerable.

The CVSS score of 5.1 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit this flaw remotely by issuing a crafted HTTP request to the /admin/?page=user/manage_user endpoint. Based on the description, the attack likely requires authentication to the administrative area, but the publicly available exploitation code suggests that once authorized, no additional privileges are necessary to inject SQL. Once executed, attackers can read, modify, or delete user data, thereby breaching confidentiality and integrity of the system.