A critical SQL injection vulnerability in SourceCodester Pharmacy Sales and Inventory System 1.0 allows unauthenticated remote attackers to compromise database integrity.

This vulnerability is a SQL injection (CWE-89) triggered by improper input validation of the ID argument within the ajax.php endpoint. The attack can be performed by an unauthenticated remote user.

Successful exploitation of this flaw allows an attacker to manipulate backend database queries, potentially leading to unauthorized data exposure, modification, or deletion. Given the CVSS score of 7.3, this represents a high risk to organizational data confidentiality and system integrity, particularly for environments relying on this system for sensitive inventory and sales records.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the application or disable the vulnerable ajax.php endpoint until a secure version is released.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected SQL syntax or unauthorized attempts to access customer tables.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the ID parameter in HTTP requests.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the GitHub issue referenced in the vulnerability report.

The presence of a public proof-of-concept elevates the risk of this vulnerability significantly. Organizations currently utilizing SourceCodester Pharmacy Sales and Inventory System 1.0 must prioritize the implementation of compensating controls, such as WAF filtering, and restrict exposure of the application to the public internet to prevent unauthorized database access.