An unauthenticated SQL injection vulnerability in the SourceCodester Pharmacy Sales and Inventory System allows remote attackers to manipulate database queries.

The application fails to properly sanitize user input in the /ajax.php endpoint when the action parameter is set to delete_receiving. This SQL injection flaw allows an unauthenticated remote attacker to execute arbitrary database commands.

The ability for an unauthenticated user to inject SQL commands poses a significant risk to data integrity and confidentiality. With a CVSS score of 7.3, this high-severity vulnerability could lead to unauthorized data exfiltration, modification of inventory records, or complete compromise of the backend database. Such an event would result in operational disruption and potential regulatory non-compliance regarding patient data.

Immediate Action: As no official patch is currently available, restrict access to the affected web application to trusted networks only and disable the vulnerable /ajax.php endpoint if it is not required for core operations.

Proactive Monitoring: Monitor server access logs for anomalous requests to the /ajax.php file, specifically looking for unusual patterns or characters commonly used in SQL injection payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the identified endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical reference provided by the security researcher at https://github.com/y1shiny1shin/vuldb-project/issues/1.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a high risk to any organization utilizing the affected software. Security teams should prioritize isolating the application from the public internet and applying strict input validation controls as a temporary measure until a vendor-supplied patch is released.