The vulnerability originates in the delete function of the admin/deleteproduct.php file, where the GET parameter ID is used directly in an SQL query without proper sanitization. Manipulating this argument allows an attacker to inject arbitrary SQL code, resulting in unauthorized data disclosure or modification. The flaw is a classic parameter-based SQL injection, classified under CWE‑74 and CWE‑89.

This flaw affects the commercially available SourceCodester Simple POS and Inventory System version 1.0. The description references the GET parameter handler component of the delete functionality in the admin interface. No other versions or products are listed, so the risk is confined to installations that have not applied a later patch.

The CVSS score of 5.1 indicates moderate severity, and the lack of an EPSS entry implies there is no current measurement of exploitation probability. Since the exploit is publicly known and can be triggered simply by sending a malicious GET request, the attack vector is remote via HTTP. The vulnerability is not listed in the CISA KEV catalog, but because it operates over the network and has a moderate rating, administrators should consider it a noteworthy risk until a patch is applied.