This vulnerability affects SourceCodester Pharmacy Sales and Inventory System 1.0, specifically the /ajax.php?action=save_product function. An attacker can manipulate the ID argument to inject SQL commands, potentially compromising the backend database. The attack vector is network-based with no privileges or user interaction required. The vulnerability has been assigned CVE-2026-7194 and carries a CVSS 4.0 score of 6.9 (medium severity). No official fix or vendor advisory is currently available, and the product is not a cloud service, so remediation depends on vendor or user action.

Successful exploitation of this SQL injection vulnerability could allow an attacker to access or modify database information, potentially leading to data disclosure or corruption. The vulnerability is remotely exploitable without authentication, increasing its risk. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, reflecting partial but not complete compromise. No known active exploitation in the wild has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider restricting access to the vulnerable endpoint, applying web application firewall (WAF) rules to detect and block SQL injection attempts, and reviewing input validation controls. Monitor vendor channels for updates or official fixes.