A remote SQL injection vulnerability in SourceCodester Pharmacy Sales and Inventory System 1.0 exposes the application to unauthorized database manipulation by unauthenticated attackers.

This is a SQL injection flaw (CWE-89) triggered by improper sanitization of the ID argument within the /ajax.php?action=chk_prod_availability endpoint. The vulnerability is exploitable by unauthenticated remote attackers.

Successful exploitation allows an attacker to interact directly with the backend database, potentially leading to unauthorized data disclosure or modification. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to the integrity and confidentiality of sensitive pharmacy inventory and sales data.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected /ajax.php endpoint or disable the vulnerable module entirely until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for suspicious requests containing SQL syntax patterns or unexpected input in the ID parameter of the ajax.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the identified vulnerable endpoint.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the research write-up at https://github.com/lingzezzz/lingze/issues/3.

Given the availability of a public proof-of-concept and the ease of remote exploitation, immediate action is required to secure the environment. Organizations currently utilizing this software must implement the recommended compensating controls immediately and monitor for unauthorized access attempts while awaiting a vendor-provided resolution.