The vulnerability lies in the view_booking.php file of Sourcecodester Cab Management System 1.0, allowing unauthenticated or authorized users to inject arbitrary SQL commands into the database. Such injection could lead to unauthorized data exposure, modification, or deletion of booking records, potentially compromising customer privacy and financial integrity. This weakness is a classic example of improper input validation, tracked as CWE‑89.

This issue affects the Cab Management System released by Sourcecodester, version 1.0. No other products or versions are listed as affected.

The CVSS base score of 2.7 indicates low severity, and the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not recorded in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector is via the web interface, where an attacker submits a crafted request to the /cms/admin/bookings/view_booking.php endpoint. The description does not state explicit authentication requirements, so it is inferred that the attacker may need access to the admin web area, but the vulnerability itself does not require privileged credentials.