The vulnerability resides in the SourceCodester Pharmacy Sales and Inventory System 1.0, specifically in the ajax.php script that processes the action=save_type parameter. Manipulation of the ID argument permits unauthenticated attackers to inject arbitrary SQL statements, compromising the confidentiality and integrity of the database. The flaw is classified as CWE-74 and CWE-89, indicating improper handling of input data and unsafe query construction.

Affected systems are installations of SourceCodester Pharmacy Sales and Inventory System 1.0. No newer versions are known from the CNA, and the vulnerability was reported for the 1.0 release. Any deployment using the standard ajax.php endpoint that accepts an ID parameter without proper validation is potentially vulnerable.

The CVSS score of 6.9 points to moderate severity, and the EPSS score is not available, so we cannot quantify current exploit likelihood. The vulnerability is not listed in CISA KEV. The likely attack vector is a remote HTTP request to /ajax.php with a malicious ID value; the attack can be performed without authentication, making it highly dangerous for exposed installations.