The vulnerability resides in the save_supplier function of /ajax.php and allows an attacker to manipulate the ID parameter to inject arbitrary SQL statements into the backend. By executing these statements, an attacker could potentially read, modify, or delete data stored in the database, thereby compromising the confidentiality, integrity, and availability of the pharmacy’s information system.

SourceCodester Pharmacy Sales and Inventory System version 1.0 is affected. No other versions or vendors are listed.

The CVSS score of 5.3 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in CISA KEV. Since remote exploitation is feasible via HTTP and an exploit is already published, the risk remains significant for anyone with network access to the application.