A flaw in the add_stock.php component of SourceCodester Sales and Inventory System version 1.0 allows an attacker to inject arbitrary SQL via the unvalidated cost parameter. The injection can alter queries sent to the underlying database, enabling data retrieval, modification, or even deletion. The vulnerability is classified as CWE‑74 and CWE‑89, underscoring both unsanitized input handling and direct user input in SQL statements.

The affected product is SourceCodester Sales and Inventory System, version 1.0, distributed by SourceCodester.

The common vulnerability scoring system rates the issue at a CVSS score of 5.3, reflecting moderate severity. The exploit prediction score is less than 1%, indicating a low probability of widespread exploitation at this time, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. The description states that the attack can be initiated remotely, implying that an unauthenticated or low‑privileged attacker could send crafted requests to the web application to trigger the injection.