The flaw resides in edit-admin.php of SourceCodester Web-based Pharmacy Product Management System 1.0. By manipulating the ID argument, an attacker can inject arbitrary SQL statements into the query that retrieves product expiry data. This vulnerability enables attackers to read, modify or delete database records through HTTP requests. The intrusion occurs remotely, requiring no local access; consequences include data exfiltration, integrity compromise, and potential financial loss.

SourceCodester Web-based Pharmacy Product Management System version 1.0 is affected. The vulnerability exists in the edit-admin.php component of the product.

The CVSS score of 5.3 indicates moderate severity, with remote exploitation possible via HTTP requests. The EPSS score is not available, but the publicly available exploit suggests it is a known vulnerability that attackers could use. The vulnerability is not listed in CISA KEV, so it has not yet been confirmed as exploited in the wild at this time. Attackers could craft malicious requests targeting the ID parameter to inject SQL, potentially gaining unauthorized database access. The lack of detailed privilege escalation hints that the impact is limited to the application’s database credentials, but any data manipulation could have significant ramifications.