SourceCodester Pharmacy Sales and Inventory System 1.0 contains a SQL injection vulnerability in the processing of the 'ID' argument within the /ajax.php?action=save_type file. This flaw permits remote attackers to inject malicious SQL code due to insufficient input validation or sanitization. The vulnerability is publicly disclosed with a CVSS 4.0 score of 6.9 (medium severity). No official fix or patch has been published, and the vendor has not provided remediation details. Exploitation could lead to unauthorized data access or modification within the affected system's database.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may result in unauthorized data disclosure, data modification, or other database-related impacts depending on the attacker's intent and database privileges. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the 'ID' parameter in the /ajax.php?action=save_type endpoint to mitigate SQL injection risks. Monitoring for unusual database activity and restricting database permissions may also reduce potential impact.