CVE-2026-8131 is a SQL injection vulnerability affecting SourceCodester SUP Online Shopping 1.0. The issue arises from improper sanitization of the msgid argument in the /admin/replymsg.php file, enabling remote attackers to inject malicious SQL code. The vulnerability requires no privileges or user interaction and has a medium severity rating with a CVSS 4.0 score of 6.9. There is no vendor-provided patch or official remediation information available at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The medium severity score reflects the potential for partial confidentiality, integrity, and availability impacts, but the exact consequences depend on the database and application context. No confirmed active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation or web application firewall rules to detect and block malicious SQL injection attempts targeting the msgid parameter in /admin/replymsg.php. Monitoring for unusual database activity related to this endpoint is also advisable.