A critical SQL injection vulnerability in SourceCodester Pharmacy Sales and Inventory System allows unauthenticated remote attackers to manipulate database queries.

This vulnerability is a SQL injection flaw (CWE-89) triggered by improper sanitization of the ID parameter within the delete_product functionality. The attack vector is unauthenticated and can be initiated remotely by sending a crafted request to the vulnerable ajax endpoint.

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive pharmacy records, modification of inventory data, or potential exfiltration of database contents. With a CVSS score of 7.3, this flaw represents a significant risk that could result in operational disruption and regulatory non-compliance.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected /ajax.php endpoint or disable the vulnerable delete_product functionality until a vendor update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual parameters directed toward the /ajax.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch against incoming malicious traffic.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability report.

Given the availability of a public proof-of-concept and the unauthenticated nature of the attack, this vulnerability requires immediate attention. Organizations utilizing SourceCodester Pharmacy Sales and Inventory System must implement compensating controls immediately and prioritize migrating to a secure alternative if the vendor fails to provide a timely patch.