This vulnerability involves an SQL injection flaw in SourceCodester Malawi Online Market 1.0, specifically in an unknown function of the /display.php file. By manipulating the ID parameter, an attacker can inject SQL commands remotely without requiring privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating a medium severity with low vector and impact complexity. Exploit code has been published, increasing the risk of exploitation. No vendor patch or fix details are provided in the available data.

Successful exploitation allows remote attackers to perform SQL injection attacks, potentially leading to unauthorized data access or modification within the affected application database. The impact is rated medium severity based on the CVSS score of 6.9. There are no reports of active exploitation in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or web application firewall rules to block malicious input targeting the ID parameter in /display.php. Monitor vendor channels for updates and patches.