The application contains an SQL injection vulnerability in the scost parameter of /grocery/search_products.php. An attacker can craft a malicious query that bypasses normal controls and extracts sensitive data from the database, such as product inventory, customer records, and sales logs. This flaw allows unauthorized read access and matches CWE-89. No impact on integrity or availability is reported.

The affected product is the Grocery Store Management System using PHP and MySQL, version 1.0, as released in the public GitHub repository. The vulnerability is present in the search_products.php script, which handles user input for product searches.

The vulnerability is exploitable over the web via the scost parameter, and attackers can construct SQL payloads when accessing the search functionality. No EPSS score is available, and the issue is not listed in CISA KEV, suggesting no confirmed widespread exploitation yet. However, SQL injection remains a high risk attack vector; if an attacker can reach the web application, they can trigger the flaw and obtain confidential data.