This vulnerability involves SQL injection via the Username argument in the /ajax.php?action=login file of SourceCodester Pharmacy Sales and Inventory System 1.0. An attacker can remotely manipulate this parameter to inject SQL commands, potentially compromising the database. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability. No official fix or patch has been documented, and no known exploits are currently observed in the wild.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium based on the CVSS score and vector, with limited but notable confidentiality, integrity, and availability impacts. Since the vulnerability is remotely exploitable without authentication, it poses a significant risk to affected systems if left unmitigated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the login endpoint. Additionally, restricting access to the affected endpoint and applying input validation or parameterized queries in the application code can help mitigate risk. Monitor vendor channels for updates on patches or official mitigations.