The flaw is a SQL injection in the ajax.php script of the Pharmacy Sales and Inventory System version 1.0. By manipulating the ID parameter, an attacker can inject arbitrary SQL into the database query, enabling remote users to read, modify, or delete data stored in the application’s database and potentially expose sensitive business or personal information. This weakness is categorized as CWE-74 and CWE-89.

The vulnerability affects the SourceCodester Pharmacy Sales and Inventory System, specifically version 1.0. No other versions or products are listed as impacted.

The CVSS score of 6.9 indicates a medium risk. The EPSS score of <1% suggests a very low probability of exploitation at this time, and the issue is not listed in CISA’s KEV catalog. The exploit is available publicly and can be launched remotely by manipulating the ID parameter in the /ajax.php?action=save_receiving endpoint. Because no authentication requirement is mentioned, it is likely that unauthenticated users can trigger the injection.