The Pharmacy Point of Sale System version 1.0 contains an unsanitized input handling flaw in the /pharmacy/manage_stock.php endpoint. This flaw allows an attacker to inject arbitrary SQL statements, leading to unauthorized data disclosure, modification, or deletion. The weakness is formally classified under CWE-89, indicating a lack of proper data validation before use in an SQL statement. The potential impact is limited to the database accessed by the application and does not provide arbitrary code execution or system compromise beyond the bounds of the application’s database permissions.

The only affected product is the Sourcecodester Pharmacy Point of Sale System, version 1.0, as identified by the CPE entry for oretnom23. No other vendor or product variants are listed as affected.

The CVSS score of 2.7 indicates a low severity assessment, and the EPSS score is reported to be less than 1 percent, suggesting low likelihood of exploitation in the wild. This vulnerability is not catalogued in the CISA KEV database. The likely attack vector is a remote web-based attacker who can send crafted input to the manage_stock.php endpoint, potentially through user interfaces or other susceptible channels. While the score reflects limited impact, the presence of a classic SQL injection flaw warrants timely remediation.