An injection flaw exists in the delete_service endpoint of the Simple Online Men's Salon Management System 1.0, allowing a malicious user to alter or execute arbitrary SQL commands against the underlying database. This can lead to unauthorized data disclosure, data modification, or deletion, compromising the confidentiality, integrity, and availability of the salon’s records. The vulnerability is a classic example of CWE‑89, where unsanitized input is incorporated directly into SQL statements.

Area exploited is the REST‑like endpoint /classes/Master.php?f=delete_service of the Simple Online Men's Salon Management System developed by oretnom23. The affected version is 1.0; no other variants or vendor versions are listed.

The CVSS score is 2.7, reflecting a low severity assessment, and the EPSS indicates less than 1% likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, underscoring its lower exposure risk. Based on the nature and typical deployment of web applications, the attack vector is inferred to be remote via HTTP, but the description does not specify whether authentication, administrative privileges, or additional prerequisites are required for exploitation.