The vulnerability is a classic SQL Injection flaw in the Pharmacy Point of Sale System, allowing an attacker to manipulate the SQL query performed through /pharmacy/manage_category.php. This injection could provide the attacker with the ability to read, modify, or delete data from the underlying database, potentially compromising the confidentiality and integrity of sensitive business information. The flaw is classified as CWE‑89, a direct consequence of unsanitized input reaching the database layer.

The affected system is the Sourcecodester Pharmacy Point of Sale System version 1.0. No other versions are listed as vulnerable.

The CVSS score for this vulnerability is 2.7, indicating low overall severity. The EPSS score is less than 1 %, suggesting a very low probability of exploitation in the near term, and the vulnerability is not listed in the CISA KEV catalog. Attackers are most likely to exploit this flaw by sending crafted requests to the /pharmacy/manage_category.php endpoint over the web. While the risk is comparatively low, the impact of successful exploitation could be significant to the affected business.