This vulnerability involves an SQL injection in the SourceCodester Pharmacy Sales and Inventory System 1.0, specifically in the /ajax.php?action=save_sales file. By manipulating the ID argument, an attacker can inject SQL commands remotely without authentication or user interaction. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed with exploit code available, but no official patch or fix has been provided by the vendor as of the publication date.

Successful exploitation allows remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. Given the affected system manages pharmacy sales and inventory, this could impact data integrity and confidentiality related to sales records and inventory management. The CVSS score of 6.9 reflects a medium severity impact with potential partial loss of confidentiality, integrity, and availability.

No official patch or remediation has been released by the vendor at this time. Users should monitor the vendor's advisory channels for updates. Until a fix is available, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the /ajax.php?action=save_sales endpoint. Additionally, review and restrict access to the affected system to trusted networks and users to reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.