A critical SQL injection vulnerability in the Pharmacy Sales and Inventory System allows unauthenticated attackers to gain unauthorized database access and potentially compromise system integrity.

This is an SQL injection vulnerability (CWE-89) located in the /ajax.php endpoint. An unauthenticated attacker can supply malicious input via the id parameter, which is processed by the backend without proper sanitization or parameterization, allowing for unauthorized SQL command execution.

Successful exploitation allows an attacker to bypass authentication mechanisms, exfiltrate sensitive pharmacy records, modify or delete critical data, and potentially gain comprehensive control over the underlying database. Given the nature of the application, this poses a significant risk to data privacy and regulatory compliance. The CVSS score of 7.3 reflects the high impact on data confidentiality and integrity, combined with the ease of remote, unauthenticated exploitation.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /ajax.php endpoint at the web server level to trusted internal networks only.

Proactive Monitoring: Review web server and database logs for anomalous requests to /ajax.php, specifically searching for SQL syntax characters such as single quotes, semicolons, or common SQL injection keywords in the id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the id parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the security researcher's technical write-up on GitHub.

The absence of a vendor-supplied patch necessitates immediate defensive action to protect the database environment. Administrators must prioritize limiting exposure by restricting network access to the application and implementing WAF rules to filter malicious traffic. Continued monitoring of system logs is essential until a formal update is released and applied.