A weakness exists in SourceCodester SUP Online Shopping 1.0 whereby the msgid argument supplied to /admin/replymsg.php is not properly sanitized, allowing attackers to inject arbitrary SQL statements. This flaw can be exploited to read, modify, or delete data from the underlying database, leading to confidentiality, integrity, and possibly availability violations for the application. The vulnerability is classified under CWE-74 and CWE-89, indicating failure to escape or validate input used in shell commands and SQL statements.

SourceCodester SUP Online Shopping version 1.0.

The CVSS score of 6.9 places this issue in the medium severity band. Although the EPSS score is not available, the fact that the flaw is exploitable from a remote location, combined with the publicly released exploit code and the lack of a CISA KEV listing, suggests a moderate to high risk of exploitation for attackers who have network access to the vulnerable machine. An attacker could inject SQL commands to gain unauthorized database access, potentially leading to data breaches or corruption.