SourceCodester SUP Online Shopping 1.0 contains a SQL injection vulnerability in the wishlist.php file. Specifically, the delwlistid parameter can be manipulated by an unauthenticated remote attacker to inject SQL commands. This vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. The vulnerability was publicly disclosed on 2026-05-08, but no official fix or patch has been published by the vendor. The vulnerability allows attackers to interfere with the application's database queries, potentially leading to unauthorized data access or modification.

Successful exploitation of this vulnerability allows a remote attacker to perform SQL injection attacks via the delwlistid parameter in wishlist.php. This can result in unauthorized access to or modification of the backend database. The CVSS score of 6.9 reflects a medium impact, with low confidentiality, integrity, and availability impacts. There is no evidence of active exploitation in the wild at this time.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider applying manual input validation or filtering on the delwlistid parameter to mitigate injection risks. Monitoring for unusual database activity related to this parameter is also advisable.