The vulnerability in SourceCodester Sales and Inventory System 1.0 allows an attacker to manipulate the sid parameter in the update_sales.php handler. This results in unsanitized input being incorporated into an SQL query, enabling arbitrary SQL injection. An attacker can execute malicious SQL statements over the network, potentially reading, modifying, or deleting data in the underlying database.

The affected product is SourceCodester Sales and Inventory System version 1.0, deployed via the update_sales.php script. The issue resides in the component handling HTTP GET parameters.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. However, the vulnerability can be triggered remotely, and a public exploit exists, raising the risk for systems still running the vulnerable version. Without an official vendor fix or workaround, attackers who discover this flaw can compromise the database directly by sending crafted GET requests to the update_sales.php endpoint.