This vulnerability involves an SQL injection in the SourceCodester Pharmacy Sales and Inventory System 1.0, specifically in the /ajax.php?action=delete_sales file. By manipulating the ID argument, an attacker can inject SQL commands remotely without authentication or user interaction. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, and no privileges required. The vulnerability is publicly known and exploit code is available, but no official patch or vendor advisory has been published to date.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited by the low scope and integrity and availability impacts rated as low. There are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the /ajax.php?action=delete_sales endpoint. Restricting access to this endpoint and validating input parameters may also reduce risk.