The SourceCodester Sales and Inventory System is vulnerable to an SQL injection in the check_item_details.php script. By manipulating the stock_name1 parameter, an attacker can inject arbitrary SQL commands. This weakness aligns with CWE‑89 (Improper Neutralization of Special Elements used in an SQL Command) and also involves CWE‑74 (Improper Neutralization of Special Elements in Filters). The flaw can be triggered remotely and the exploit is publicly available. If successful, the attacker could read, modify, or delete data in the underlying database, thereby compromising confidentiality, integrity, and availability.

SourceCodester Sales and Inventory System version 1.0 and all earlier releases are affected. The vulnerability exists in the function that processes the stock_name1 argument within check_item_details.php.

The flaw has a CVSS score of 5.3, indicating a moderate impact. The EPSS score is less than 1%, suggesting that exploitation is unlikely but still possible. It is not listed in the CISA Known Exploit Vulnerabilities catalog. Based on the description, the likely attack vector is remote, with the attacker able to inject SQL through the stock_name1 parameter.