This vulnerability affects SourceCodester Pharmacy Sales and Inventory System 1.0. The issue is located in the save_supplier function of the /ajax.php endpoint, where improper validation of the ID parameter leads to SQL injection. This allows remote attackers to manipulate backend database queries by injecting malicious SQL code. The vulnerability has a CVSS 4.0 score of 5.3, indicating a medium severity level. Although an exploit is publicly available, no active exploitation has been reported. No official fix or patch is currently documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. Given the medium CVSS score and the lack of known active exploitation, the immediate impact is moderate but could escalate if exploited in the wild.

No official patch or remediation is currently available from the vendor. Users should monitor vendor advisories for updates. Until a fix is released, restricting access to the vulnerable endpoint and applying web application firewall (WAF) rules to detect and block SQL injection attempts may help mitigate risk. Avoid exposing the affected system to untrusted networks if possible.