SourceCodester Pharmacy Sales and Inventory System 1.0 contains an SQL injection vulnerability in the save_expired function accessed via /ajax.php?action=save_expired. The vulnerability arises from improper sanitization of the ID argument, allowing an attacker to inject arbitrary SQL commands remotely. The CVSS 4.0 base score is 5.1 (medium severity) with network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. No official patch or remediation level has been published, and the product is not a cloud service. Public exploits exist but no known exploitation in the wild has been confirmed.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries on the backend database remotely, potentially leading to unauthorized data access or modification. The impact is rated medium based on CVSS 4.0 scoring, reflecting limited but non-negligible confidentiality, integrity, and availability impacts. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable endpoint and implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter in /ajax.php?action=save_expired. Monitor for updates from SourceCodester regarding patches or official mitigations.