The vulnerability stems from a failure to properly sanitize user-supplied input before incorporating it into a SQL query. Specifically, the id parameter in index.php is directly concatenated into a SQL query without any form of input validation or escaping. This allows an attacker to inject malicious SQL code, such as UNION SELECT statements or commands to modify or retrieve data from the database. The root cause is a lack of input validation and parameterized queries, leading to SQL injection.