SourceCodester Pharmacy Sales and Inventory System 1.0 contains a SQL injection vulnerability in the /ajax.php?action=delete_receiving endpoint. The vulnerability arises from insufficient input validation of the 'ID' parameter, enabling remote attackers to inject malicious SQL commands. This can lead to unauthorized database access or manipulation. The CVSS 4.0 score is 6.9, reflecting a medium severity with network attack vector, no privileges required, and no user interaction needed. No official patch or remediation level has been provided by the vendor as of the published date. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database. This may result in unauthorized data access, modification, or deletion within the affected system. Given the medium CVSS score and public exploit availability, there is a tangible risk to confidentiality and integrity of data managed by the affected software. However, no confirmed exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the vulnerable endpoint, implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'ID' parameter, and consider disabling or limiting the use of the affected functionality if feasible. Monitoring for unusual database activity related to this endpoint is also advisable.