This vulnerability affects SourceCodester Inventory and Monitoring System 1.0. An attacker can exploit a SQL injection flaw by manipulating the difficulty_id argument in the /admins/assessments/databank/btn_functions.php?action=add endpoint. The flaw allows remote, unauthenticated attackers to inject SQL commands, potentially leading to unauthorized data access or modification. Public exploit code exists, increasing the risk of exploitation. No official patch or remediation information is provided in the available data.

Successful exploitation can lead to unauthorized SQL command execution on the backend database, potentially exposing or altering sensitive data. The vulnerability is remotely exploitable without authentication, increasing the attack surface. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, consistent with a medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the difficulty_id parameter.