The vulnerability is an SQL injection in the index.php of the Inventory and Monitoring System. An attacker can craft a specially‑constructed Username value that is inserted directly into a database query, allowing manipulation of the query logic. This flaw can lead to unauthorized data retrieval, modification, or deletion, and if application logic extends injection to the database itself, it could enable remote code execution. The weakness is a classic input validation failure, reflected in CWE‑74 (Improper Validation of Input) and CWE‑89 (SQL Injection).

Systems running SourceCodester Inventory and Monitoring System version 1.0 are affected. The vulnerability originates in an unknown function within index.php – any deployment of this product that relies on the default login mechanism is susceptible. The index.php file is the entry point exposed on the web, thus all publicly accessible instances of the product are vulnerable.

The CVSS score of 6.9 indicates moderate to high severity. The EPSS score is below 1 %, suggesting that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The attack can be launched remotely over the network without any authentication, so the potential impact is significant if an attacker can reach the web interface. Discovery of the issue has been publicly disclosed through community channels, and an exploit already exists. Defense requires rapid patching or mitigating the input handling.