The Pharmacy Point of Sale System v1.0 contains an SQL injection vulnerability in the "/pharmacy/manage_user.php" endpoint. Input parameters are concatenated directly into an SQL query without sanitization, allowing an attacker to inject arbitrary SQL. This can lead to unauthorized reading, modification, or deletion of data stored in the backend database, compromising the confidentiality, integrity, and availability of the application.

Installations of oretnom23’s Pharmacy Point of Sale System version 1.0 are affected. No other versions are listed as impacted, and no vendor patch is available. Users running this version are exposed to the flaw.

The CVSS score of 9.8 classifies the flaw as critical. The EPSS score of <1% indicates a low but non‑zero exploitation probability. The vulnerability is exploitable over the network by sending crafted requests to the vulnerable endpoint; authentication is not mentioned in the description, suggesting that the endpoint may be reachable without prior authentication. Because SQL injection can result in data compromise and potential escalation to further attacks, the risk remains high despite the low exploitation probability.