A critical SQL injection vulnerability in SourceCodester Pharmacy Sales and Inventory System 1.0 allows for unauthenticated remote exploitation, posing a significant risk to data integrity.

The application is vulnerable to SQL injection within the ajax.php file, specifically via the action=delete_customer parameter. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands into the backend database.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive pharmacy records, modification of inventory data, or potential exfiltration of customer information. Given the CVSS score of 7.3, this high-severity vulnerability represents a substantial threat to the confidentiality and integrity of the pharmacy management environment.

Immediate Action: Since a formal vendor patch is currently unknown, users should immediately restrict access to the affected system by placing it behind a secure VPN or firewall, or disable the vulnerable component if it is not business-critical.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests targeting ajax.php, particularly those containing SQL syntax characters like single quotes or union statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the identified endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

The presence of a publicly available proof-of-concept elevates the risk of this vulnerability significantly. Organizations utilizing SourceCodester Pharmacy Sales and Inventory System version 1.0 must treat this as a high-priority issue and implement compensating controls immediately to prevent unauthorized database manipulation while awaiting a formal vendor security update.