A SQL injection vulnerability exists in CodeAstro Simple Pharmacy Management System version 1.0 within the /SimplePharmacy-PHP/product/delete.php endpoint. The vulnerability arises from improper processing of the ID parameter, enabling remote attackers with low privileges to inject malicious SQL commands. This can lead to unauthorized data access or modification. Public exploit code is available, but there is no indication of active exploitation in the wild. The CVSS v3.1 score is 6.3, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation can lead to unauthorized disclosure, modification, or deletion of data within the affected system. The vulnerability affects confidentiality, integrity, and availability to a limited extent. Since the attack can be launched remotely and requires low privileges, it poses a moderate risk to affected deployments.

No official patch or remediation guidance is currently available. Users should monitor the vendor's advisory for updates. Until a fix is released, restricting access to the vulnerable endpoint and employing web application firewalls to detect and block SQL injection attempts may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.