A flaw in SourceCodester Sales and Inventory System 1.0 allows an attacker to supply a crafted value in the searchtxt parameter of dashboard.php, resulting in an unsanitized SQL query. This classic SQL injection can expose, alter, or delete data in the underlying database. Because the injection can be triggered by a simple web request, an attacker can read, modify, or delete confidential sales and inventory records.

The vulnerability exists only in SourceCodester Sales and Inventory System version 1.0, specifically in the Search component accessed via dashboard.php. No other vendors or product versions are listed as affected.

The severity score of 5.3 indicates moderate risk, and the estimated exploit probability is below one percent. No confirmed public exploits have been reported, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack path is remote over HTTP/HTTPS, where a crafted searchtxt value can be sent without authentication, enabling unauthorized data access or manipulation.