The Simple Pharmacy Management System contains an input validation failure in delete.php that allows a remote attacker to inject arbitrary SQL by manipulating the ID parameter. This weakness can result in disclosure of sensitive pharmacy records, unauthorized manipulation of inventory or transaction data, and potential full compromise of the underlying database if permissions are broad. The flaw falls under CWE‑74 and CWE‑89 for incorrect sanitization and the use of unparameterized queries.

This issue is found in CodeAstro's Simple Pharmacy Management System version 1.0. The application is hosted on a web server where the file SimplePharmacy-PHP/product/delete.php is publicly accessible. No other versions or modules have been confirmed, and no official CVE‑affected version list beyond 1.0 is available, so the scope is limited to installations that have deployed that exact release.

The CVSS score of 5.3 indicates a moderate severity, yet the vulnerability is exploitable remotely via crafted HTTP requests; it has no known local privilege or environmental prerequisites. Because an explosion of publicly available exploits has been reported on the internet, the attack vector is clearly remote. With no EPSS data available, the precise exploitation probability cannot be quantified, but the presence of public exploits suggests a non‑negligible threat. The vulnerability is not listed in the CISA KEV catalog, which means it has not yet been confirmed as a known exploited vulnerability at the scale of national compromise. Consequently, organizations using this software should assess their exposure and apply mitigations promptly.