A SQL injection vulnerability exists in SourceCodester Computer Repair Shop Management System 1.0 within the delete_product function located in /classes/Master.php. The vulnerability arises from improper sanitization of the ID argument, allowing remote attackers to inject SQL commands. This can lead to unauthorized information disclosure, data manipulation, or denial of service. The CVSS 3.1 base score is 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database. This may result in unauthorized disclosure of sensitive information, modification or deletion of data, and potential disruption of service. The impact is rated as moderate based on the CVSS score and the nature of SQL injection vulnerabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint and implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the delete_product function. Monitor for updates from the vendor or trusted security advisories for official patches or mitigations.