The vulnerability is a classic SQL Injection flaw found in the delete appointment function of the Sourcecodester Online Men’s Salon Management System. An attacker can inject arbitrary SQL commands via the f=delete_appointment parameter, allowing unauthorized extraction, modification, or deletion of data stored in the underlying database. This weakness is identified as CWE-89, where unsanitized input is passed directly to SQL queries.

The affected product is the Sourcecodester Online Men’s Salon Management System, version 1.0. No other vendors or products are listed in the published data. The file causing the issue resides in /msms/classes/Master.php within the application.

The CVSS score of 2.7 indicates a low severity assessment, and the EPSS score of less than 1% shows a very low probability of exploitation at the time of analysis. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is a remote web request to the exposed endpoint, where an attacker crafts a malicious payload to be executed by the database.