This vulnerability involves SQL injection in the SourceCodester Computer Repair Shop Management System up to version 1.0. The injection point is the ID parameter in the /admin/products/manage_product.php script, which can be manipulated remotely without authentication. The vulnerability could allow attackers to execute arbitrary SQL commands with limited impact scope as indicated by the CVSS vector. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. No official patch or fix has been published by the vendor as of the last update.

Successful exploitation could allow an attacker to execute unauthorized SQL commands on the backend database, potentially leading to unauthorized data access or modification with limited impact scope. The vulnerability does not require authentication or user interaction, increasing its risk. However, the overall impact is rated medium due to limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter in /admin/products/manage_product.php. Restricting access to the admin interface and employing input validation or parameterized queries in custom deployments may reduce risk.