This vulnerability exists in the check_customer_details.php POST handler of SourceCodester Sales and Inventory System 1.0. Manipulating the stock_name1 argument allows an attacker to inject arbitrary SQL into the backend database. The injection can expose sensitive customer and inventory information, alter records, or potentially compromise the database. The flaw is identified as CWE-74 and CWE-89.

The affected product is SourceCodester Sales and Inventory System version 1.0. Only the /check_customer_details.php endpoint’s POST handler is impacted. No other versions or components are listed as vulnerable.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is reported as less than 1%, implying a low likelihood of exploitation in the wild, and the vulnerability is not catalogued in the CISA KEV. The attack vector is remote; an unauthenticated or authenticated user who can send crafted POST requests to the vulnerable endpoint may exploit the flaw. The exploit does not require special prerequisites beyond accessing the web application and does not depend on additional system weaknesses.