An unauthenticated SQL injection vulnerability in the SourceCodester Pharmacy Sales and Inventory System allows remote attackers to compromise database integrity and confidentiality.

This is a SQL injection vulnerability (CWE-89) located in the /ajax.php file. An unauthenticated attacker can manipulate the id parameter to execute arbitrary SQL queries against the backend database.

Successful exploitation permits unauthorized access to the application database, which may lead to the exfiltration of sensitive pharmacy and inventory data. Given the CVSS score of 7.3, this vulnerability poses a significant risk to data confidentiality and integrity, potentially resulting in regulatory non-compliance and reputational damage.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /ajax.php endpoint via network controls or web server configurations until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for anomalous POST requests to /ajax.php containing SQL syntax or unusual characters in the id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the id parameter.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the provided GitHub repository issue.

Given the availability of a public proof-of-concept and the lack of authentication required for exploitation, this vulnerability presents a clear and present danger to affected systems. Organizations must prioritize restricting access to the vulnerable endpoint immediately and should monitor for any signs of unauthorized database interaction until the vendor provides a formal security update.