This vulnerability in SourceCodester Pharmacy Sales and Inventory System 1.0 allows an unauthenticated remote attacker to perform SQL injection via the ID parameter in the /ajax.php?action=save_category endpoint. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official fix or patch has been documented, and the vendor has not provided remediation guidance. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited but non-negligible confidentiality, integrity, and availability impacts. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable endpoint, applying web application firewall rules to detect and block SQL injection attempts, and monitoring for suspicious activity related to the /ajax.php?action=save_category endpoint. Avoid relying on generic mitigations unless they specifically address this vulnerability.