This vulnerability affects SourceCodester Pharmacy Sales and Inventory System 1.0. It involves SQL injection via manipulation of the 'ID' argument in the /ajax.php?action=chk_prod_availability file. The vulnerability allows an unauthenticated remote attacker to execute arbitrary SQL commands due to insufficient input validation. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and limited impact on confidentiality, integrity, and availability. No official fix or patch has been disclosed, and the exploit is publicly available.

Successful exploitation could allow an attacker to execute arbitrary SQL queries on the backend database, potentially leading to unauthorized data access or modification. The impact is limited to the confidentiality, integrity, and availability of the affected system's database. There is no indication of privilege escalation or system-level compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or web application firewall (WAF) rules to block malicious SQL injection attempts targeting the 'ID' parameter in the affected endpoint. Monitor for updates from SourceCodester regarding patches or official mitigations.