A flaw in the save_shop_type routine of SourceCodester’s Multi‑Vendor Online Grocery Management System allows an attacker to inject arbitrary SQL through crafted POST data. The injection occurs without any obvious input encoding or sanitization, giving the attacker the ability to read, modify, or delete database rows that belong to the application. This results in a breach of data confidentiality and integrity confined to the backend database, with no evidence of an availability impact in the provided description.

The vulnerability exists in version 1.0 and 5.7.26 of the SourceCodester Multi‑Vendor Online Grocery Management System, which is delivered as a web application. The service is publicly reachable, and the vulnerable POST endpoint can be invoked by any client that can reach the web interface. The affected component is the POST Parameter Handler in the Master.php file.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of less than 1% shows a low probability of exploitation in the wild. The vulnerability is publicly disclosed and can be triggered remotely with a correctly crafted HTTP POST request to the save_shop_type endpoint. No authentication requirement is described in the data, so the attack could be successful against systems that expose the endpoint without additional access controls.