A flaw exists in the cancel_order endpoint of SourceCodester’s Multi‑Vendor Online Grocery Management System where the user‑supplied ID parameter is concatenated into a SQL statement without validation. This permits an attacker to inject arbitrary SQL code, potentially compromising the confidentiality and integrity of the database, and may lead to unauthorized data modification or deletion. The vulnerability is mapped to CWE‑74 (Improper Neutralization of Special Elements used in a Safe Context) and CWE‑89 (SQL Injection).

Affected entities are SourceCodester’s Multi‑Vendor Online Grocery Management System version 1.0, as identified by the vendor/product entry in the CVE record. No other vendors or product versions are listed as impacted.

The CVSS score of 5.3 classifies this issue as medium severity. The EPSS score of less than 1% indicates a low probability of exploitation in the current threat landscape, and the vulnerability is not catalogued in CISA KEV. The description confirms that an attacker can remotely trigger the flaw by sending a crafted POST request to the cancel_order endpoint. Successful exploitation would depend on the privileges granted to the database account used by the application, allowing unauthorized data manipulation or potentially more destructive actions.