The vulnerability is an SQL injection flaw in the /admin/message.php file of SourceCodester SUP Online Shopping 1.0. By manipulating the argument seenid, an attacker can inject arbitrary SQL code into a backend query. The flaw allows the attacker to read or modify database contents, potentially exposing sensitive order, user, or payment information, and could be abused to alter or delete data. The weakness is identified as CWE-74 and CWE-89, reflecting improper handling of query components and unsanitized input.

The affected product is SourceCodester SUP Online Shopping running version 1.0. The flaw resides in an unknown function of the admin message page, and it has not been narrowed to any specific subcomponent beyond the presence of the seenid parameter in that script.

The CVSS score is 6.9, indicating a moderate severity vulnerability. The EPSS score is not available, and the flaw is not currently listed in CISA KEV, but public exploit scripts have been published, implying that an attacker can feasibly exploit the flaw remotely. The likely attack vector is a web request that directly supplies a crafted seenid value. Given the public availability of the exploit and the ability to execute arbitrary SQL commands, the risk to affected systems is significant for confidentiality and integrity.