This vulnerability involves an SQL injection in the SourceCodester Pharmacy Sales and Inventory System 1.0, specifically in the /ajax.php?action=delete_sales function. By manipulating the ID argument, an attacker can inject malicious SQL commands remotely without any privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating a medium severity level. No official fix or patch is currently documented, and the system is not cloud-hosted, so remediation depends on vendor or user action.

Successful exploitation allows remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. The vulnerability requires no authentication and no user interaction, increasing its risk. However, the impact is rated medium severity, reflecting some limitations in scope or exploitability. There are no known exploits observed in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as a temporary mitigation. Monitoring for unusual database activity may help detect exploitation attempts. No vendor advisory or official patch links are currently provided.