Based on the description, it is inferred that the flaw originates from insufficient sanitization of user supplied parameters. The Pharmacy Point of Sale System version 1.0 contains a classic SQL Injection flaw in the /pharmacy/view_category.php script due to insufficient sanitization of user supplied parameters. An attacker can inject malicious SQL code that is passed directly to the database engine, allowing read, update, delete, or even schema-altering operations on the underlying datastore. The vulnerability can lead to data exposure, integrity compromise, and potentially give the attacker full control over the application database.

The affected product is Pharmacy Point of Sale System, version 1.0, owned by vendor oretnom23 as indicated by the CPE entry. The vulnerability resides in the publicly accessible PHP script /pharmacy/view_category.php and affects all installations running this specific version without an applied fix.

Based on the description, it is inferred that the attack vector is remote via the web interface and that the vulnerable endpoint is publicly accessible. The CVSS score of 9.8 marks this flaw as critical, while the EPSS score of less than 1% suggests that exploitation likelihood is currently very low. The system is not listed in the CISA KEV catalog. However, the attacker can reach the vulnerable endpoint without authentication, making the risk of exploitation primarily opportunistic but high impact once achieved.