The SourceCodester Sales and Inventory System 1.0 contains an unfiltered GET parameter "sid" in update_customer_details.php that permits an attacker to inject arbitrary SQL statements. By manipulating this argument, an attacker can read, modify, or delete customer records and gain access to sensitive data. The flaw represents a classic input validation weakness classified under both CWE‑74 and CWE‑89.

The compromised components are limited to the Sales and Inventory System released by SourceCodester, version 1.0. Only the update_customer_details.php script handling the "sid" parameter is affected, and no other versions or downstream releases have been reported as vulnerable.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The description states the attack can be executed remotely; it does not specify that local privileges are required, so it is inferred that reaching the publicly accessible HTTP endpoint is sufficient for exploitation. An attacker would send a crafted GET request to the vulnerable URL, with the injected SQL payload embedded in the sid parameter, without needing authentication or elevated privileges.