The flaw resides in the view_supplier.php component, where the POST parameter searchtxt is improperly sanitized, allowing an attacker to inject SQL code. This vulnerability can be exploited from a remote location and may be used to read, modify, or delete data stored in the application’s database, compromising the confidentiality, integrity, and availability of sensitive business information.

The affected product is SourceCodester Sales and Inventory System version 1.0, distributed by SourceCodester.

With a CVSS score of 5.3 the risk is moderate, and the EPSS score indicates low current exploitation probability (<1%). The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote POST request to view_supplier.php using the searchtxt parameter, and the exploit has been made publicly available.