The vulnerability resides in the file /rsms/admin/services/view_service.php of the Computer and Mobile Repair Shop Management System version 1.0. An attacker can inject arbitrary SQL through input parameters, allowing the execution of unauthorized queries. This can lead to unauthorized data retrieval, modification, or deletion of sensitive business information such as service records, customer details, or financial data. The weakness is identified as SQL Injection (CWE‑89).

The affected product is the Sourcecodester Computer and Mobile Repair Shop Management System, version 1.0, deployed as a PHP web application on a web server. No official vendor is listed, and the product appears to be community‑produced. Systems running this version with the view_service.php file exposed to unauthenticated or weakly authenticated users are at risk.

The CVSS score of 2.7 indicates a low severity, and an EPSS score below 1% suggests the vulnerability is unlikely to be widely exploited in the near term. It is not listed in the CISA KEV catalog. The likely attack vector is through the web interface, where an attacker submits a specially crafted request to the view_service.php script. No official patch or workaround is documented, so the vulnerability remains exploitable until the application is updated or input handling is hardened.