This vulnerability exists in SourceCodester Pharmacy Sales and Inventory System 1.0 within the delete_expired function of the /ajax.php endpoint. By manipulating the ID parameter, an attacker can inject SQL commands remotely, potentially compromising the database. The CVSS 4.0 vector indicates network attack vector with low complexity and no user interaction required, but requires high privileges. The vulnerability is publicly known but lacks an official fix or patch at this time.

Successful exploitation could allow an attacker with high privileges to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is limited by the requirement for high privileges and the vulnerability's low to limited scope and impact metrics in the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected function and validate or sanitize input parameters to mitigate SQL injection risks. Monitor for updates from SourceCodester regarding patches or official mitigations.