Sourcecodester Storage Unit Rental Management System version 1.0 contains a classic SQL injection flaw in the manage_pricing.php script, which is part of the admin maintenance interface. An attacker who can reach that endpoint can inject arbitrary SQL commands, potentially reading, modifying, or deleting pricing data. This weakness aligns with the standard SQL Injection category and can lead to unauthorized data disclosure or tampering.

The only confirmed affected product is Sourcecodester Storage Unit Rental Management System version 1.0. The vulnerability is localized to the admin maintenance folder, specifically manage_pricing.php. No other vendors or product versions have been identified.

The CVSS base score of 2.7 classifies the flaw as low severity. EPSS is not publicly available, and the flaw is not listed in the CISA KEV catalog, suggesting limited current exploitation interest. However, the likely attack scenario requires access to the protected admin interface, which implies that an adversary would need either compromised administrative credentials or a publicly reachable admin page. If such access is obtained, the low severity does not diminish the risk of unauthorized data manipulation. Because this is a classic injection flaw, exploitation conditions are simple once the target endpoint is reachable.