A vulnerability exists in SourceCodester Air Cargo Management System 1.0, specifically within the save_cargo_type function of Master.php. Malicious manipulation of the ID argument allows an attacker to inject arbitrary SQL statements. The injection leads to unauthenticated remote access to the underlying database, enabling data exfiltration, modification, or deletion, and is categorized under CWE-89 and CWE-74.

The affected product is SourceCodester Air Cargo Management System, version 1.0. No other versions are listed as affected. The vulnerability is located in the file /classes/Master.php and impacts the save_cargo_type functionality.

The CVSS score of 5.1 indicates moderate severity. An exploit is publicly disclosed and can be performed remotely without authentication. Because the flaw is a classic SQL injection, an attacker can read or modify database contents. The vulnerability is not part of the CISA KEV catalog, and the EPSS score is not available, yet the existence of a known exploit confirms its practicality. The impact could span all installations of version 1.0 that have not been patched or mitigated.