This vulnerability affects SourceCodester Pharmacy Sales and Inventory System 1.0. It arises from improper sanitization of the ID parameter in the /ajax.php?action=delete_product file, enabling remote attackers to inject SQL commands. The vulnerability allows attackers to manipulate backend database queries, potentially leading to unauthorized data access or modification. The CVSS 4.0 vector indicates the attack requires no privileges or user interaction and has low to limited impact on confidentiality, integrity, and availability.

Successful exploitation could allow an unauthenticated remote attacker to perform SQL injection attacks against the backend database via the ID parameter. This may lead to unauthorized data access or modification within the affected system. However, the impact is rated medium, reflecting limited confidentiality, integrity, and availability consequences as per the CVSS vector. There are no reports of active exploitation in the wild at this time.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. In the meantime, applying input validation and sanitization on the ID parameter or implementing web application firewalls to detect and block SQL injection attempts may help mitigate risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.