An unknown function within the admin interface viewmsg.php may allow an attacker, by manipulating the msgid request parameter, to inject arbitrary SQL statements. This flaw falls under CWE-89 and could be used to read, modify or delete data in the underlying database, compromising confidentiality and integrity. Although no direct evidence of code execution is provided, exploitation of the database could potentially lead to further compromise if malicious statements alter application logic.

SourceCodester SUP Online Shopping version 1.0 is affected. The vulnerability resides in the /admin/viewmsg.php file and no other versions or components are mentioned.

The CVSS score of 6.9 indicates medium severity, and EPSS information is not available, so the likelihood of exploitation is uncertain. The flaw is publicly disclosed and can be triggered remotely by crafting a malicious msgid parameter, meaning any machine that can reach the application could potentially exploit it. The vulnerability is not listed in the CISA KEV catalog, but public exploit code suggests it could be used in the wild.