SourceCodester Sales and Inventory System 1.0 contains a SQL injection vulnerability in the /update_stock.php component. The vulnerability arises from improper sanitization of the 'sid' HTTP GET parameter, enabling an attacker to manipulate SQL queries executed by the application. This can lead to unauthorized database access or modification. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity, with network attack vector, no privileges required, and no user interaction needed. The vulnerability is publicly disclosed but lacks an official patch or vendor advisory.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity based on the CVSS score of 5.3. There is no indication of confirmed active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or web application firewall rules to detect and block malicious SQL injection attempts targeting the 'sid' parameter in /update_stock.php. Monitor for vendor updates regarding patches or official mitigations.