This vulnerability affects SourceCodester Pharmacy Sales and Inventory System 1.0. It arises from improper sanitization of the ID parameter in the /ajax.php?action=delete_product functionality, enabling remote attackers to inject SQL commands. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 6.9, indicating medium severity. There is no vendor advisory or patch available at this time, and the exploit code has been publicly disclosed.

Successful exploitation of this SQL injection vulnerability could allow attackers to manipulate backend database queries, potentially leading to unauthorized data access or modification. The exact impact depends on the database and application context but may include data leakage or integrity compromise. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint and applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter in /ajax.php?action=delete_product.