An SQL injection flaw exists in the Pharmacy Point of Sale System version 1.0, specifically in the /pharmacy/view_supplier.php module. Attackers able to craft malicious input can inject arbitrary SQL statements, enabling enumeration of database contents, extraction of sensitive records, and modification or deletion of data. The vulnerability permits unauthorized disclosure of customer and supplier information and could lead to integrity violations.

Targeted applications are the open‑source Pharmacy Point of Sale System released by oretnom23, version 1.0. No other versions are listed. The vulnerable code resides in the web front‑end, exposing the flaw to HTTP requests.

With a CVSS score of 9.8, the flaw is considered critical. The EPSS value is below 1 %, indicating current exploitation likelihood is low but not impossible; however, the absence from KEV suggests no publicly known exploits yet. The attack vector is inferred to be remote, as the vulnerable endpoint is reachable over the network. Successful exploitation would immediately compromise confidentiality and integrity of the underlying database, potentially allowing a remote attacker to read, modify, or delete data.