This vulnerability affects SourceCodester SUP Online Shopping 1.0. An attacker can remotely exploit a SQL injection flaw by manipulating the msgid parameter in the /admin/viewmsg.php file. This allows unauthorized SQL commands to be executed on the backend database, potentially leading to data leakage or modification. The vulnerability is remotely exploitable without authentication and has a medium severity rating based on CVSS 4.0 metrics. No vendor-provided patch or mitigation details are currently available.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL queries on the application's database. This may result in unauthorized access to sensitive data, data modification, or other database impacts. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, and no active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected /admin/viewmsg.php functionality and apply web application firewall (WAF) rules to detect and block SQL injection attempts targeting the msgid parameter. Monitor vendor channels for updates on patches or official mitigations.