This vulnerability in SourceCodester Pharmacy Sales and Inventory System 1.0 involves SQL injection via the 'ID' argument in the /ajax.php?action=delete_receiving file. An attacker can remotely exploit this flaw to inject malicious SQL commands due to insufficient input validation or sanitization. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, no privileges required, and no user interaction needed. The vulnerability is publicly known and exploitable, but no official fix or mitigation has been documented.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication, increasing the risk of compromise. However, the impact is rated medium, suggesting limited scope or complexity in exploitation consequences. No evidence of widespread exploitation in the wild is currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is documented, users should monitor vendor communications for updates. Until a patch is available, restricting access to the vulnerable endpoint and employing web application firewalls with SQL injection detection rules may help mitigate risk.