A vulnerability in the SourceCodester Sales and Inventory System 1.0 allows an attacker to inject arbitrary SQL through the purchaseid GET parameter in purchase_invoice.php. The flaw arises from unsanitized input handling in the GET parameter handler, enabling malicious queries that can read, modify, or delete database contents. If exploited, an attacker could compromise data confidentiality and integrity, potentially affecting all users of the system.

This issue affects the SourceCodester Sales and Inventory System version 1.0, specifically the purchase_invoice.php module that processes the purchaseid GET argument. No other versions or components are listed as affected.

The CVSS base score of 5.3 categorizes the vulnerability as moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation at the present time, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is remote, and no authentication is required; an adversary can trigger the injection simply by crafting a specially crafted URL. Given that the exploit is publicly available, the risk to affected installations remains significant, particularly in environments lacking input sanitization or access controls.