Sourcecodester Pharmacy Point of Sale System version 1.0 contains a SQL injection flaw in the manage_product.php endpoint. This weakness allows an attacker to inject arbitrary SQL statements through unsanitized input, potentially enabling unauthorized data retrieval, modification, or deletion within the underlying database. It is identified as CWE‑89, indicating a lack of proper input handling before query execution.

The affected product is Sourcecodester Pharmacy Point of Sale System v1.0, which hosts the /pharmacy/manage_product.php page on web servers. No other versions or variants are listed in the advisory, so the vulnerability is limited to this specific release.

With a CVSS score of 2.7 the risk is considered low to moderate. The EPSS score is below 1%, indicating a very low likelihood of exploitation. Attackers could likely exploit it remotely by sending specially crafted HTTP requests to the manage_product.php endpoint, assuming the application does not enforce strict input validation or use parameterized queries.