This vulnerability affects SourceCodester Pharmacy Sales and Inventory System 1.0. The issue is due to insufficient input validation or sanitization of the 'ID' argument in the /ajax.php?action=chk_prod_availability file, which leads to SQL injection. An attacker can remotely exploit this flaw by manipulating the 'ID' parameter to execute arbitrary SQL queries on the backend database. The CVSS 4.0 base score is 6.9, indicating a medium severity level with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. No official patch or vendor advisory is available, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts as per the CVSS 4.0 vector. There is no indication of privilege escalation or requirement for user interaction, making remote exploitation feasible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and sanitization on the 'ID' parameter at the application or database level to mitigate SQL injection risks. Monitoring and restricting access to the vulnerable endpoint may also reduce exposure.