A critical SQL injection vulnerability in SourceCodester Pharmacy Sales and Inventory System 1.0 allows unauthenticated remote attackers to compromise the application database.

This is a SQL injection flaw (CWE-89) located in the /ajax.php endpoint. An unauthenticated attacker can supply malicious input to the Username parameter to interact directly with the backend database.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized data exposure, modification, or deletion of sensitive pharmacy inventory and sales records. Given the CVSS score of 7.3, this represents a high-severity risk that could facilitate complete database compromise, resulting in significant operational disruption and loss of data integrity.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected web application or take the service offline until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns targeted at the /ajax.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns and sanitize input directed at the Username parameter.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided in the referenced GitHub issue.

The presence of a public proof-of-concept combined with the unauthenticated nature of this attack makes this a high-priority concern. Organizations currently running this software must implement immediate network-level restrictions or disable the affected component to prevent unauthorized database access.