The flaw is an unsanitized "ID" parameter in the /ajax.php?action=chk_prod_availability endpoint of SourceCodester Pharmacy Sales and Inventory System 1.0. By injecting malicious SQL through this argument, an attacker can execute arbitrary database commands. The vulnerability is exploitable from the internet and a public exploit is available, meaning an attacker can read, modify, or delete inventory, pricing, and transaction records. The single compromised record could lead to full system compromise, loss of integrity and confidentiality.

SourceCodester Pharmacy Sales and Inventory System version 1.0 is affected. No other affected versions are listed. The vulnerability is tied to the vendor’s "Pharmacy Sales and Inventory System" product.

The CVSS score of 6.9 indicates medium‑high impact; the lack of an EPSS score does not negate the known public exploit, suggesting a realistic threat. The CVE is not included in the CISA KEV list, but attackers can easily trigger it over the network with a crafted request to /ajax.php?action=chk_prod_availability&ID=… to bypass authentication and gain unauthorized database access. The risk is significant for any deployment that relies on the default install.