The Pharmacy Point of Sale System version 1.0 contains an uncontrolled SQL injection flaw in the /pharmacy/view_product.php endpoint. An attacker who can supply crafted input directly into the SQL query can execute arbitrary database commands, potentially reading sensitive business data, modifying inventory or transaction records, or compromising the entire database. This vulnerability is classified as CWE-89 and represents a serious threat to the confidentiality and integrity of the system’s information.

The affected product is Pharmacy Point of Sale System version 1.0, developed by oretnom23 and distributed via the Sourcecodester platform. No other versions or vendors are listed, so the scope is limited to this specific release.

The CVSS score of 9.8 marks this flaw as critical, while the EPSS is listed as less than 1%, indicating a low current likelihood of exploitation. The vulnerability is not present in the CISA KEV catalog. Attackers would most likely target the exposed web endpoint over the network, sending malicious payloads in HTTP requests. No special conditions beyond access to the /pharmacy/view_product.php page are required.