A remote SQL injection flaw exists in the search.php file of SourceCodester Simple POS and Inventory System version 1.0. Attackers can manipulate the Name argument, causing the application to include unsanitized user input directly in a database query. This vulnerability allows attackers to read, modify, or delete data within the POS and inventory databases, which could compromise the confidentiality, integrity, and availability of the system. The flaw is classified as CWE‑74 and CWE‑89.

The affected product is SourceCodester Simple POS and Inventory System 1.0. Users of this version should verify whether their installation contains the unpatched search.php that accepts a Name parameter via HTTP requests.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score is not available and the vulnerability is not listed in CISA KEV. An attacker can exploit the flaw remotely over the network, and an exploit has already been published. The impact hinges on database access privileges; if the database user has elevated rights, a successful injection could lead to full system takeover. Because the application accepts the input over HTTP, any user with network access to the web server can craft a malicious request.