A flaw in the update_stock.php script of SourceCodester Sales and Inventory System 1.0 allows an attacker to insert arbitrary SQL code through the sid query parameter. The injection can modify, read, or delete database records, thereby compromising the confidentiality and integrity of business data. The vulnerability is classed as a data‑breach risk rather than direct code execution, but the potential for extensive data manipulation makes it a serious threat.

SourceCodester’s Sales and Inventory System, version 1.0. The flaw resides in the HTTP GET parameter handler for update_stock.php and affects any installation of this version that has not been patched.

The CVSS score of 5.3 indicates moderate severity, while an EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is publicly disclosed and can be exploited remotely without additional authentication, but it is not listed in the Trusted Exploits catalog. An attacker would typically craft a malicious sid value and send a crafted GET request to the vulnerable endpoint, leading to arbitrary SQL execution against the application’s database.