This vulnerability affects SourceCodester Pharmacy Sales and Inventory System 1.0. An attacker can remotely exploit an SQL injection flaw by manipulating the ID argument in the /ajax.php?action=save_product file. This allows unauthorized SQL commands to be executed on the backend database, potentially leading to data exposure or modification. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability. The vulnerability is publicly known but no official fix or patch has been published by the vendor as of now.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access or modification within the affected system. The impact is rated medium severity with limited confidentiality, integrity, and availability impact as per the CVSS vector. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the ID parameter in /ajax.php?action=save_product to mitigate SQL injection risks. Monitor for vendor updates regarding patches or official mitigations.