This vulnerability affects SourceCodester Computer Repair Shop Management System up to version 1.0. It is caused by improper sanitization of the ID argument in the /admin/products/manage_product.php file, leading to SQL injection. An attacker can remotely exploit this flaw without authentication or user interaction, potentially allowing partial compromise of the underlying database. The CVSS 4.0 base score is 6.9, reflecting network attack vector, low complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. No official patch or vendor remediation level has been published as of now.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impact as per the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected endpoint and implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter in /admin/products/manage_product.php. Monitor for updates from SourceCodester regarding patches or official mitigations.