A SQL injection flaw exists in the delete_supplier endpoint of SourceCodester Pharmacy Sales and Inventory System. By manipulating the ID parameter in /ajax.php?action=delete_supplier, an attacker can inject arbitrary SQL statements. The vulnerability is exploitable from a remote location and can result in unauthorized access to, alteration of, or deletion of database contents. The weakness is classified as CWE-74 (SQL Injection via string concatenation) and CWE-89. The existence of a publicly disclosed exploit raises the risk of exploitation.

The affected product is SourceCodester Pharmacy Sales and Inventory System version 1.0. The flaw resides in the ajax.php script that handles supplier deletion requests. Only this product version and that specific request handler are listed as impacted.

The CVSS score of 5.3 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote since the description states the attack can be executed from outside the system. Exploitation requires the ability to send crafted HTTP requests to the vulnerable endpoint; no authentication is mentioned as a prerequisite, suggesting the flaw may be exploitable without prior login. Given the public availability of the exploit and the moderate CVSS score, organizations should treat this as a significant security risk.