A critical SQL injection vulnerability in the SourceCodester Pharmacy Sales and Inventory System allows unauthenticated remote attackers to compromise database integrity and access sensitive data.

This vulnerability is a SQL injection flaw located in the /ajax.php endpoint, specifically within the save_product action. An unauthenticated attacker can inject malicious SQL commands through the id parameter, which is processed by the application without sufficient validation or parameterization.

Successful exploitation of this vulnerability can lead to unauthorized access to the underlying database, potential data exfiltration, or modification of inventory and sales records. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially resulting in operational disruption and loss of sensitive pharmacy information.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /ajax.php endpoint or disable the affected functionality until the vendor provides a security update.

Proactive Monitoring: Review web server and application logs for suspicious POST requests to /ajax.php that contain SQL syntax or unexpected character patterns in the id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming traffic containing common SQL injection payloads directed at the vulnerable /ajax.php endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the GitHub issue referenced by the vulnerability data.

The presence of a public proof-of-concept combined with the lack of authentication requirements makes this vulnerability a high priority for remediation. Organizations currently running version 1.0 of the Pharmacy Sales and Inventory System must implement the suggested WAF controls or disable the exposed endpoint immediately to prevent unauthorized database access.