A critical SQL injection vulnerability in SourceCodester Pharmacy Sales and Inventory System 1.0 allows unauthenticated remote attackers to manipulate database queries.

This vulnerability is a SQL injection flaw (CWE-89) triggered by improper sanitization of the ID argument within the /ajax.php?action=save_category endpoint. The vulnerability is exploitable by unauthenticated remote attackers.

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive pharmacy records, inventory data, or potential database compromise. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent unauthorized data exfiltration or system manipulation.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /ajax.php endpoint via network-level controls or web server configuration.

Proactive Monitoring: Monitor server access logs for anomalous requests containing SQL syntax or unusual parameters directed toward the /ajax.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the identified vulnerable endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of public proof-of-concept code and the ease of exploitation, this vulnerability presents a clear risk to environments running the affected system. Organizations should prioritize isolating the vulnerable application from public access until a security update is provided by the vendor. Immediate implementation of WAF rules and heightened monitoring is essential to mitigate the risk of exploitation.