The vulnerability allows SQL injection through manipulation of the ID argument in the "/ajax.php?action=save_customer" endpoint. An attacker can inject arbitrary SQL to read, modify, or delete data stored in the pharmacy sales database. Because the application does not validate or escape this input, the injected statements are executed with the database credentials of the web application.

SourceCodester Pharmacy Sales and Inventory System, version 1.0. The flaw resides in an unknown function of the ajax.php file handling the save_customer action.

The CVSS score of 6.9 indicates a medium severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, requiring an attacker to craft requests to the /ajax.php endpoint. Public exploit code has been disclosed, suggesting that exploitation is achievable without complex prerequisites.