The SourceCodester Pharmacy Sales and Inventory System version 1.0 suffers from an input handling flaw in its save_expired function located in ajax.php. An attacker can manipulate the ID parameter to inject arbitrary SQL statements, a vulnerability grouped under CWE-74 and CWE-89. This flaw allows a remote attacker to read, modify, or delete database contents, potentially exposing sensitive pharmacy data.

The vulnerable product is SourceCodester Pharmacy Sales and Inventory System 1.0, downloadable from sourcecodester.com. The flaw resides in the AJAX endpoint /ajax.php?action=save_expired, where the ID parameter is not properly sanitized.

The CVSS score of 5.1 indicates moderate risk, and no EPSS value is available; the vulnerability is not listed in the CISA KEV catalog. Publicly released exploit code demonstrates that a remote attacker can target any accessible instance to execute the SQL injection against the ID parameter.