This vulnerability involves an SQL injection in the SourceCodester Pharmacy Sales and Inventory System 1.0. Specifically, the issue is in an unknown function within the /ajax.php?action=delete_category file, where the ID argument is not properly sanitized, allowing an attacker to inject SQL commands. The vulnerability is remotely exploitable without any privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating a medium severity level. No official patch or remediation guidance has been published by the vendor or authoritative sources.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion within the affected system. The vulnerability does not require authentication or user interaction, increasing the risk of remote exploitation. However, the overall impact is rated medium due to limited details on the extent of data exposure or control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the vulnerable endpoint and implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the /ajax.php?action=delete_category parameter. Monitor for any updates from the vendor regarding patches or official mitigations.