SQL Injection Flaw Found in Pharmacy System: Exploit Available

The National Vulnerability Database (NVD) has flagged a critical SQL injection vulnerability in SourceCodester Pharmacy Sales and Inventory System version 1.0. The flaw resides within the /ajax.php?action=delete_sales endpoint, specifically when handling the ID argument. Attackers can exploit this by manipulating the ID parameter to inject malicious SQL code, potentially leading to unauthorized data access or modification.

This vulnerability, cataloged as CVE-2026-6188, carries a CVSS score of 7.3 (HIGH). The NVD notes that the attack can be initiated remotely and requires no specific privileges or user interaction, making it a significant threat. Crucially, the exploit code for this vulnerability has already been published, increasing the likelihood of active exploitation in the wild.

Given the availability of the exploit and the ease of remote execution, organizations utilizing SourceCodester Pharmacy Sales and Inventory System 1.0 should treat this as an immediate risk. The NVD associates this vulnerability with CWE-74 (Improper Neutralization of Special Elements in Output Used as a Security Construct) and CWE-89 (Improper Neutralization of Special Elements used in SQL Commands).