An unauthenticated SQL injection vulnerability in SourceCodester Pharmacy Sales and Inventory System 1.0 poses a significant risk of unauthorized database manipulation.

The application is vulnerable to SQL injection within the /ajax.php endpoint via the ID parameter. This flaw allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database.

The vulnerability carries a CVSS score of 7.3, indicating a high level of risk. Successful exploitation could lead to unauthorized access to sensitive pharmacy data, potential data exfiltration, or modification of inventory and sales records. Such compromises may result in significant operational disruption and loss of data integrity.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the application and monitor the /ajax.php endpoint for suspicious activity.

Proactive Monitoring: Review web server access logs for requests to /ajax.php containing SQL syntax patterns or unusual ID parameter values.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing SQL injection payloads targeting the ID parameter in the pharmacy system.

Public Exploit Available: Yes, a public proof-of-concept is available via the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations utilizing this system must implement strict network segmentation and WAF filtering to prevent unauthorized database access until a formal vendor update is released.