SourceCodester Pharmacy Sales and Inventory System 1.0 contains an SQL injection vulnerability in the /ajax.php?action=save_receiving endpoint. The vulnerability arises from improper handling of the ID argument, allowing an attacker to inject malicious SQL commands remotely without requiring privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating a medium severity level. The vulnerability was publicly disclosed on 2026-04-27, with no official patch or remediation level specified by the vendor. Exploit code is publicly available, but no active exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion, potentially compromising the confidentiality and integrity of the system's data. Since the attack vector is remote and requires no privileges or user interaction, the risk is significant for affected systems that remain unpatched.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to implement input validation and parameterized queries on the affected endpoint if possible. Restricting access to the vulnerable endpoint and monitoring for suspicious activity may also help reduce risk.