The flaw is an SQL injection vulnerability in the wishlist.php file of SourceCodester SUP Online Shopping. An attacker can exploit a lack of input validation when manipulating the delwlistid parameter, allowing the injection of arbitrary SQL commands into a query that is then executed against the database. Because the vulnerable code is reachable via an HTTP request from any remote user, an attacker could read, modify, or delete application data, potentially exposing customer information or corrupting the product catalog. The weakness is identified as CWE‑89 and the CVSS score of 6.9 rates the issue as medium severity.

The vulnerability affects the SUP Online Shopping open‑source application released by SourceCodester, specifically version 1.0. Any deployment that has the wishlist.php page and accepts the delwlistid argument is susceptible. This includes both community‑hosted copies and self‑managed instances that have not applied updates.

The EPSS score is not available, so the current probability of exploitation remains unknown, but the vulnerability is publicly disclosed and remote‑exploitable. The lack of a CISA KEV listing does not reduce risk, because an attacker can instruct a web client to send a crafted request to the vulnerable endpoint. The CVSS score reflects the potential impact on confidentiality and integrity without requiring elevated privileges. Organizations should view this as a legitimate threat that could be leveraged to compromise data or alter application state.