This vulnerability in SourceCodester Water Billing Management System 1.0 involves SQL injection via manipulation of the ID parameter in the user management component located at /admin/?page=user/manage_user. The flaw allows remote attackers to inject SQL commands, potentially compromising the backend database. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low complexity, and no user interaction required. The vulnerability was published on 2026-06-01, but no vendor remediation or patch is currently documented.

Successful exploitation could allow an attacker with high privileges to execute arbitrary SQL commands on the database, potentially leading to unauthorized data access or modification. The impact is limited by the requirement of high privileges (PR:H) but can still pose a risk to data integrity and confidentiality within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected user management module to trusted administrators only and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable interface to untrusted networks.