A SQL injection vulnerability exists in the delete_supplier functionality of SourceCodester Stock Management System 1.0. By manipulating the ID argument, an attacker can inject arbitrary SQL into the backend query. The flaw is classified as CWE‑74 (Improper Neutralization of Input) and CWE‑89 (Improper Neutralization of Special Elements used in an SQL Command).

The affected product is SourceCodester Stock Management System 1.0, an open‑source inventory application. Any installation of this version that exposes the /classes/Master.php?f=delete_supplier endpoint is potentially vulnerable. The issue is present in the vendor’s released code and does not depend on additional configuration beyond exposing the endpoint.

The CVSS score of 5.1 indicates a medium severity. The EPSS score is not available, so the likelihood of exploitation remains unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers can launch the exploit remotely by sending a crafted request to the delete_supplier endpoint with a malicious ID value. No prerequisite authentication is described, so the flaw could be abused by unauthenticated users if the endpoint is publicly accessible.