The Sourcecodester Pharmacy Point of Sale System version 1.0 contains an SQL Injection vulnerability in the manage_supplier.php handler. An attacker can supply specially crafted input that is interpolated directly into database queries, allowing unauthorized read or modification of supplier records. This flaw may enable data disclosure, tampering, or the execution of arbitrary SQL commands, potentially compromising the integrity of the transaction database.

The affected product is Sourcecodester Pharmacy Point of Sale System, version 1.0. No additional vendor or product variants are listed.

The CVSS score is 2.7, indicating low severity, and the EPSS score is below 1%, suggesting a very low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is externally accessible, since the flaw exists in a publicly reachable web endpoint. An attacker would need to craft an HTTP request containing malicious input to the /pharmacy/manage_supplier.php script. Because the database credentials used by the application likely have standard privileges, the impact might be limited to data read/write, but unpatched systems remain at risk.