A weakness in the sell_statement function of SourceCodester Pharmacy Sales and Inventory System allows improper access controls, giving an attacker the ability to view sales statements that should be restricted to authorized users. The CVE description confirms that the issue can be exploited remotely, and the referenced CWE identifiers indicate an authorization bypass and improper access control flaw.

SourceCodester Pharmacy Sales and Inventory System version 1.0 is affected. No other vendors or product versions are listed.

The CVSS score of 6.9 places this vulnerability in the medium severity range. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers can launch the exploit remotely, potentially exposing confidential sales data and creating a foothold for further attacks if additional sensitive areas are accessible. While the impact is not critical, the ability to bypass access controls over a public endpoint warrants immediate attention.