The vulnerability is an unsanitized injection point in the /ajax.php?action=save_sales endpoint of SourceCodester Pharmacy Sales and Inventory System 1.0, corresponding to CWE-74 (Improper Sanitization) and CWE-89 (SQL Injection). By altering the value of the ID parameter, an attacker can embed arbitrary SQL code that the backend database will execute. This allows the potential disclosure, modification, or deletion of data stored in the system. The flaw can be triggered from a remote location, and the existence of a publicly available exploit suggests that an attacker can craft a request with malicious SQL without needing additional credentials.

The affected product is SourceCodester Pharmacy Sales and Inventory System version 1.0. No other versions or sub‑products are mentioned as vulnerable.

The CVSS score of 6.9 indicates medium severity and highlights the capacity for data compromise. The EPSS score is less than 1 percent, reflecting a low current exploitation probability, yet the public availability of an exploit increases the risk. The flaw is not listed in the CISA KEV catalog. A successful attack requires an attacker to contact the web application, send a forged request to the /ajax.php?action=save_sales URL with a malicious ID payload, and relies on the server executing that payload against the connected database.