A classic SQL injection flaw exists in the file /cms/admin/categories/view_category.php of the Sourcecodester Cab Management System version 1.0. This weakness allows an attacker to inject arbitrary SQL statements, potentially enabling read, modify, or delete operations on the underlying database. The impact is a compromise of the confidentiality and integrity of sensitive data stored by the application, such as cab bookings, customer records, and financial information. The vulnerability is identified as CWE‑89.

The only product explicitly affected is the Sourcecodester Cab Management System, version 1.0. No other vendors or products are listed as impacted.

The CVSS score of 2.7 suggests a low‑to‑moderate severity, and the EPSS score of less than 1% indicates a low projected likelihood of exploitation. The flaw is not included in the CISA KEV list. The attack vector is inferred to be remote, via the web interface exposed by the application. Since the flaw arises from unsanitized user input in a publicly accessible PHP script, an attacker with network access to the webserver can exploit it without additional credentials.