A vulnerability in SourceCodester Sales and Inventory System up to version 1.0 allows attackers to inject arbitrary SQL by manipulating the 'sid' argument in the /add_sales_print.php file. This SQL injection can compromise data confidentiality by exposing database records and may also lead to integrity impacts if the injection is used to modify or delete data. It does not provide remote code execution but could be used to extract or alter sensitive information.

The affected product is SourceCodester Sales and Inventory System, version 1.0. The vulnerability is tied to the add_sales_print.php file and affects installations of this version and earlier as listed by the CNA and the CPE string for the product.

The CVSS base score is 5.3, indicating a moderate severity. The EPSS score is below 1%, suggesting low probability of widespread exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote HTTP request to /add_sales_print.php with a crafted 'sid' parameter, as there is no indication of required authentication or additional prerequisites, so the exploitation path is straightforward for an external attacker.