Description
A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Impacted is an unknown function of the file /ajax.php?action=delete_sales. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
Published: 2026-04-13
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Patch Immediately
AI Analysis

Impact

A flaw exists in the /ajax.php action delete_sales of SourceCodester Pharmacy Sales and Inventory System version 1.0. Manipulating the ID argument leads to SQL injection, allowing an attacker to read, modify, or delete data from the underlying database. The vulnerability can be triggered remotely via crafted HTTP requests, and an exploit has already been published.

Affected Systems

SourceCodester Pharmacy Sales and Inventory System 1.0 is affected. The issue is confined to the delete_sales functionality within /ajax.php, but the impact extends to any data accessible through the database connection used by the application.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. Exploit probability data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, requiring only access to the web application, and a published exploit suggests realistic risk for exposed installations.

Generated by OpenCVE AI on April 13, 2026 at 19:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor patch or upgrade to a version that sanitizes the ID parameter in delete_sales.
  • If no patch is available, modify the code to use parameterized queries or enforce strict input validation for the ID argument.
  • Configure the database user employed by the application to have the least privilege necessary for normal operation.
  • Restrict inbound traffic to the web server or specifically to the /ajax.php endpoint using firewall or access control, limiting exposure.
  • Monitor application and database logs for anomalous queries or repeated injection attempts.

Generated by OpenCVE AI on April 13, 2026 at 19:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Apr 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Apr 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester pharmacy Sales And Inventory System
Vendors & Products Sourcecodester
Sourcecodester pharmacy Sales And Inventory System

Mon, 13 Apr 2026 16:15:00 +0000

Type Values Removed Values Added
Description A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Impacted is an unknown function of the file /ajax.php?action=delete_sales. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
Title SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Pharmacy Sales And Inventory System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-14T16:29:30.432Z

Reserved: 2026-04-13T08:36:28.794Z

Link: CVE-2026-6188

cve-icon Vulnrichment

Updated: 2026-04-14T15:23:21.693Z

cve-icon NVD

Status : Deferred

Published: 2026-04-13T16:16:36.380

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-6188

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-14T16:34:09Z

Weaknesses