A flaw in Pharmacy Point of Sale System v1.0 allows attackers to inject arbitrary SQL statements via the /pharmacy/view_receipt.php page, potentially exposing or altering sensitive data in the database. The vulnerability is classified as an SQL injection (CWE‑89) flaw. No additional details about input handling are provided in the advisory.

The affected product is Pharmacy Point of Sale System version 1.0. No vendor information is supplied by the CNA; the system runs the sourcecodester code package.

The vulnerability carries a CVSS base score of 9.8, indicating critical severity and potential impact on confidentiality and integrity of the underlying database. The EPSS score of less than 1% suggests a very low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. The flaw can be triggered by sending a specially crafted HTTP request to the exposed PHP page, so the likely attack vector is remote web‑based, though specific authentication requirements are not detailed in the advisory.