The flaw exists in the delete_expired function of the pharmacy inventory system. By supplying a crafted value for the ID parameter, a remote attacker can inject arbitrary SQL statements into the query executed by the server. This enables the exploitation of code injection and SQL injection weaknesses (CWE‑74 and CWE‑89). The attack can compromise the confidentiality and integrity of the underlying database, potentially allowing data exfiltration, modification, or deletion.

SourceCodester Pharmacy Sales and Inventory System version 1.0 is affected by this vulnerability. The issue resides in the /ajax.php file when the action delete_expired is requested.

With a CVSS score of 5.1, the vulnerability represents a medium severity risk. The EPSS score is not available, but a publicly available exploit has been documented, indicating that remote attackers could successfully leverage the flaw. The vulnerability is not listed in the CISA KEV catalog.