A SQL injection flaw exists in the SourceCodester Sales and Inventory System 1.0 when the sid parameter is passed to the /update_supplier.php endpoint via an HTTP GET request. By supplying a crafted sid value, an attacker can inject arbitrary SQL statements. This may allow the attacker to read, modify, or delete data stored in the system’s database, thus compromising the confidentiality, integrity, and availability of the application’s data.

The affected product is SourceCodester Sales and Inventory System version 1.0. The vulnerability is located in the update_supplier.php component of the HTTP GET request handler. Any deployment of this version that exposes the update_supplier.php endpoint is susceptible.

The CVSS score is 5.3, indicating moderate severity, while the EPSS score is less than 1% suggesting a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. The exploit can be triggered remotely by sending an HTTP GET request to /update_supplier.php with a malicious sid value. No information is provided about authentication requirements or privilege escalation.