A flaw in SourceCodester Pharmacy Sales and Inventory System 1.0 allows an attacker to manipulate the ID parameter in the ajax.php?action=save_category endpoint, resulting in a SQL injection that can be exploited remotely. This vulnerability is a classic input validation weakness (CWE-74 and CWE-89) that can enable unauthorized modification or extraction of database records. The impact is data confidentiality and integrity compromise, potentially exposing sensitive pharmacy information.

The affected product is SourceCodester Pharmacy Sales and Inventory System 1.0, specifically the ajax.php handler that processes category saving operations. Any deployment of this version that exposes the /ajax.php endpoint to external users is vulnerable. No vendor version updates or hotfixes are listed in the provided data, so systems remain at risk until addressed.

The CVSS score of 6.9 classifies the vulnerability as moderately severe, and while no EPSS score is available, the exploit code has been released to the public, indicating a realistic threat of exploitation. The vulnerability can be reached over the network by directly targeting the Ajax endpoint from any remote host, making it a remote attack vector. The vulnerability is not currently listed in CISA’s KEV catalog, but the public availability of an exploit combined with the moderate score warrants immediate attention.