The flaw resides in the SourceCodester Pharmacy Sales and Inventory System 1.0, inside an undocumented function within /ajax.php when the action parameter is set to delete_category. By manipulating the ID argument, an attacker can inject arbitrary SQL code, allowing alteration or exfiltration of the underlying database and compromising data confidentiality and integrity.

This issue affects the single product SourceCodester Pharmacy Sales and Inventory System version 1.0. No other affected versions are documented. The parameter that triggers the injection is the ID field in the delete_category action.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread known exploitation yet. The description states that the attack can be performed from remote, implying that an unauthenticated attacker with network access to the web application can exploit the flaw by sending a crafted request to the delete_category endpoint. The lack of input validation and the use of raw query building provide the conditions for exploitation.