The create_supplier function in the Pharmacy Sales and Inventory System accepts the Address/Company Name parameter and writes it directly into a CSV file without sanitisation. By injecting spreadsheet‑compatible formulas such as =cmd|/, an attacker can trigger arbitrary command execution when the CSV is opened in a spreadsheet application, giving the attacker remote code execution capabilities. This flaw is a classic CSV injection vulnerability, identified as CWE‑74.

SourceCodester Pharmacy Sales and Inventory System versions 1.0 and earlier are affected. The issue exists in the Supplier Creation Interface component, specifically the create_supplier function located in /Export_csv/export. Any deployment of this product that has not applied a later patch is susceptible.

The vulnerability carries a CVSS score of 5.1, indicating medium severity. EPSS data is not available, and it is not listed in the CISA KEV catalog, but the description states that remote exploitation is possible and the exploit has been publicly disclosed. The likely attack vector is remote, relying on a malicious CSV file delivered to a user who opens it in an office application. While the risk level reflects moderate exploitation potential, the presence of a publicly known exploit warrants prompt mitigation.