The vulnerability resides in the save_client method of the registration handler in SourceCodester Multi‑Vendor Online Grocery Management System 1.0. The Name field is inserted into an SQL query without proper sanitization or use of prepared statements, allowing an attacker to inject arbitrary SQL. This can result in unauthorized access to, or modification of, database information. The flaw is an instance of CWE‑74 and CWE‑89, both reflecting improper neutralization of special elements in SQL commands. The impact, if exploited, is loss of database confidentiality and integrity.

The only system impacted is SourceCodester Multi‑Vendor Online Grocery Management System version 1.0, as documented by the vendor, the CPE entry, and the advisory references.

The vulnerability carries a CVSS score of 6.9, indicating medium severity, and an EPSS score of less than 1 %, showing a very low but non‑zero exploitation probability. It is not cataloged in CISA’s KEV, yet a public exploit is now available and can be launched remotely via the registration interface. No authentication requirement is explicitly mentioned, so the attack can be attempted by unauthenticated users who can reach the registration endpoint.