A SQL injection flaw exists in the HTTP GET handler of update_out_standing.php in SourceCodester Sales and Inventory System 1.0. By manipulating the sid parameter, an attacker can inject arbitrary SQL statements into the backend database. This allows retrieval or alteration of data, violating data confidentiality and integrity and potentially enabling further compromise of the system.

The vulnerable component is part of SourceCodester Sales and Inventory System version 1.0. The issue is documented for the SourceCodester product and is reported in the public vulnerability database for that specific version.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests that public exploitation is currently unlikely, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can exploit the flaw remotely by crafting a malicious URL containing a malicious sid value, as the vulnerability is triggered through an HTTP GET request.