The flaw resides in the ajax.php script that processes the login action, where the Username parameter is not properly sanitized. This allows an attacker to inject arbitrary SQL statements, potentially bypassing authentication or modifying database contents. The weakness is a classic SQL injection, identified as CWE-89. The likely attack vector is a remote HTTP request to /ajax.php?action=login containing a crafted Username value, a scenario inferred from the description, which states the attack can be launched remotely.

SourceCodester Pharmacy Sales and Inventory System, version 1.0, uses the ajax.php file during user authentication.

The CVSS score of 6.9 reflects a moderate threat level. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can exploit the flaw remotely by sending HTTP requests with malicious input; if successful, the attacker could read or modify sensitive data. The risk therefore encompasses confidentiality and integrity compromise and is considered significant due to the potential for widespread data exposure.