A defect resides in the administrative endpoint mensproductdeletequery.php of SourceCodester Simple and Nice Shopping Cart Script, allowing an attacker to inject arbitrary SQL commands by manipulating the user_id parameter. The code concatenates unsanitized input directly into an SQL statement, which can be exploited to modify or delete user data, exfiltrate confidential information, or disrupt service. This flaw represents an instance of the classic SQL injection weakness.

The vulnerability is present in version 1.0 of SourceCodester Simple and Nice Shopping Cart Script, specifically within the PHP file deployed under the /admin directory. Systems running this version should verify that the file is deployed and that any externally reachable user_id interface is confined to the administrative context. No other versions were reported as affected.

Based on the description, it is inferred that the attacker can trigger the flaw via a remote HTTP request to the administrative script, manipulating the user_id parameter; the attack requires the admin interface to be reachable and may benefit from weak authentication. The CVSS score of 6.9 classifies it as medium severity, and the EPSS score of less than 1 % indicates a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploits, yet publicly disclosed proof‑of‑concept code exists, underscoring the need for timely remediation.