An input validation flaw in the /admin/girlsproductdeletequery.php script permits a crafted user_id value to be inserted directly into a database query. The resulting SQL injection can let an attacker read, modify, or delete arbitrary data from the underlying MySQL database, potentially exposing sensitive customer information to remote execution via an HTTP request targeting the exposed endpoint.

The vulnerability affects SourceCodester Simple and Nice Shopping Cart Script version 1.0, specifically the administrative area that processes product deletion requests. Only installations that include the unpatched girlsproductdeletequery.php file are vulnerable; newer or custom deployments may not be impacted.

With a CVSS score of 6.9 the issue is considered moderate severity. The EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the description does not mention authentication requirements and the endpoint resides in the admin area, it is inferred that the script may be reachable without prior login, which would heighten exposure. The attack vector is remote, delivered via standard HTTP requests.