The vulnerability is an SQL injection flaw located in the SourceCodester Simple and Nice Shopping Cart Script file /admin/userproductdeletequery.php. By manipulating the user_id parameter, an attacker can inject arbitrary SQL commands that are executed by the backend database. This weakness falls under CWE-89 and may also involve unsanitized input handling (CWE-74). The impact includes the potential for unauthorized data disclosure, tampering, or deletion, which is inferred from the nature of SQL injection and affects the integrity and confidentiality of product and administrative data.

SourceCodester Simple and Nice Shopping Cart Script version 1.0 is affected. The vulnerability resides in the admin module script /admin/userproductdeletequery.php, which, based on the file path, is inferred to be part of the back‑end administration interface. Any installation running this version without applying the latest fix is vulnerable.

The CVSS score is 6.9, indicating a moderate severity. The EPSS score is under 1%, showing a low probability that the vulnerability is actively exploited, and it is not included in the CISA KEV catalog. The flaw can be triggered remotely by sending a crafted HTTP request containing a malicious user_id value to the affected endpoint. The successful exploit would grant the attacker the ability to execute arbitrary SQL commands against the application database.