This vulnerability exists in SourceCodester Simple POS and Inventory System 1.0 within the deleteproduct.php file's delete function. The issue arises from improper handling of the ID parameter in the GET request, enabling SQL injection attacks. The vulnerability can be exploited remotely by an attacker with high privileges and does not require user interaction. The CVSS 4.0 base score is 5.1, indicating medium severity. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker with high privileges to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data manipulation or disclosure. The vulnerability is exploitable remotely and the exploit is publicly known, increasing the risk of attack. However, the impact is rated medium due to the requirement for high privileges and limited scope of the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected functionality to trusted users only and consider implementing web application firewall rules to detect and block SQL injection attempts targeting the ID parameter in /admin/deleteproduct.php.