Description
A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=delete_product. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Published: 2026-04-27
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Patch
AI Analysis

Impact

A SQL injection flaw exists in the delete product functionality of SourceCodester Pharmacy Sales and Inventory System 1.0. An attacker can manipulate the ID parameter sent to /ajax.php?action=delete_product to inject arbitrary SQL statements. This allows unauthorized read, modification or deletion of database contents, compromising confidentiality, integrity and possibly availability.

Affected Systems

The vulnerability affects the SourceCodester Pharmacy Sales and Inventory System version 1.0. No other versions or variants are listed. The flaw resides in a publicly accessible ajax endpoint and would impact any installation that has not been updated or patched.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. EPSS is not available, and the issue is not currently listed in the CISA KEV catalog. However, the flaw is exploitable over the network through a standard HTTP request, and the public exploit code mentioned in the advisories suggests that it is likely in use or easy to replicate. Because no restrictions on the target are specified, any remotely reachable instance could be targeted, increasing the risk for hosted environments.

Generated by OpenCVE AI on April 28, 2026 at 12:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade SourceCodester Pharmacy Sales and Inventory System to the latest release or apply the vendor‑issued patch that fixes the SQL injection in the delete product endpoint.
  • Modify the application code to validate the ID parameter as a numeric value and to use prepared statements or parameterized queries before executing SQL commands.
  • Restrict access to the /ajax.php endpoint by enforcing authentication and proper authorization checks, ensuring only privileged users can invoke delete_product operations.

Generated by OpenCVE AI on April 28, 2026 at 12:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 28 Apr 2026 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester pharmacy Sales And Inventory System
Vendors & Products Sourcecodester
Sourcecodester pharmacy Sales And Inventory System

Mon, 27 Apr 2026 23:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=delete_product. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Title SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Pharmacy Sales And Inventory System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-28T14:48:37.412Z

Reserved: 2026-04-27T13:52:04.701Z

Link: CVE-2026-7199

cve-icon Vulnrichment

Updated: 2026-04-28T14:48:33.618Z

cve-icon NVD

Status : Deferred

Published: 2026-04-28T00:16:26.987

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-7199

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T13:00:15Z

Weaknesses