This vulnerability involves an SQL injection in the SourceCodester Pharmacy Sales and Inventory System 1.0. Specifically, the issue is in the /ajax.php?action=save_sales file where the ID argument can be manipulated to inject SQL commands. The attack vector is network accessible without authentication or user interaction, and the vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No official fix or patch is currently documented, and the exploit code has been publicly released.

Successful exploitation allows remote attackers to execute arbitrary SQL commands on the backend database via the ID parameter in the save_sales action. This can lead to unauthorized data access, modification, or deletion within the affected system. The vulnerability does not require privileges or user interaction, increasing its risk. However, the impact is rated medium due to limited information on the extent of data exposure or system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the affected endpoint to mitigate SQL injection risks. Monitoring for unusual database activity and restricting access to the vulnerable endpoint may also reduce exposure.