A vulnerability exists in the SourceCodester E-Commerce Site 1.0 within the products.php script. Malicious actors can supply an arbitrary search query through the Search parameter, which is inserted directly into a SQL statement without proper sanitization. This flaw can lead to remote SQL injection, allowing attackers to extract, modify, or delete data stored in the underlying database. The weakness corresponds to CWE-74 and CWE-89 vulnerabilities.

Systems affected are installations of SourceCodester E-Commerce Site version 1.0 running the products.php module. The vulnerability is located in unknown or undocumented code that processes the Search argument. Administrators of web applications built on this platform should verify that the specific file is present and check whether the version has been patched by the vendor.

The CVSS score of 6.9 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the KEV catalog, but an exploit is publicly documented. The attack can be conducted remotely by issuing HTTP requests to products.php with a crafted Search value. Operators should therefore treat this flaw as a realistic threat until a vendor patch becomes available.