SourceCodester SUP Online Shopping 1.0 contains an SQL injection vulnerability in the wishlist.php file. Specifically, the delwlistid parameter can be manipulated by an unauthenticated remote attacker to inject SQL commands. This vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. The vulnerability is publicly known but no official fix or patch has been published by the vendor. The vulnerability allows attackers to interfere with the application's database queries, potentially leading to unauthorized data access or modification.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform SQL injection attacks against the application's database. This may result in unauthorized access to or modification of database information. The CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, consistent with a medium severity rating. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users of SourceCodester SUP Online Shopping 1.0 should monitor vendor communications for updates. In the meantime, restricting access to the affected functionality or implementing web application firewall (WAF) rules to detect and block SQL injection attempts may help mitigate risk.