The vulnerability in SourceCodester Simple Client Management System 1.0 arises from improper sanitization of the ID parameter in the save_service function located in /classes/Master.php. This flaw enables remote attackers to perform SQL injection attacks by manipulating this argument, potentially leading to unauthorized data access or modification. The CVSS 3.1 base score is 7.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available.

Successful exploitation of this SQL injection vulnerability can lead to unauthorized disclosure, modification, or deletion of data within the affected system. The vulnerability affects confidentiality, integrity, and availability of the system. Since the attack can be performed remotely without authentication, it poses a significant risk to exposed installations of the affected software.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected functionality, applying web application firewalls with SQL injection detection, and monitoring for suspicious activity related to the vulnerable endpoint. Avoid exposing the affected service to untrusted networks.