The vulnerability is a SQL injection flaw located in the view_product.php script of SourceCodester Sales and Inventory System 1.0. By manipulating the searchtxt argument in an HTTP POST request, an attacker can inject arbitrary SQL statements, potentially allowing unauthorized reading or alteration of the underlying database and exposing sensitive inventory data.

The flaw is present in all deployments of SourceCodester Sales and Inventory System version 1.0. Any installation that has not yet applied a fix or upgrade is susceptible, as the vulnerability resides in the HTTP POST request handler of the view_product.php file.

The CVSS score is 5.3, representing moderate severity, while an EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is publicly documented and can be triggered remotely via a crafted POST request to the searchtxt parameter. Although it is not listed in the CISA KEV catalog, administrators should treat it as a valid security concern and address it promptly.