This vulnerability exists in SourceCodester Multi-Vendor Online Grocery Management System 1.0 within the save_client function of classes/Users.php in the Registration Handler component. An attacker can remotely exploit improper sanitization of the Name parameter to inject SQL commands. The vulnerability is confirmed and publicly disclosed, but no official patch or remediation guidance is currently available from the vendor. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to execute arbitrary SQL commands on the backend database remotely by manipulating the Name parameter. This can lead to unauthorized data access or modification, potentially compromising the confidentiality and integrity of the system's data. The impact is rated medium based on the CVSS score of 6.9.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider applying input validation or web application firewall (WAF) rules to detect and block SQL injection attempts targeting the save_client function.