This vulnerability in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote attackers to inject SQL commands via the ID parameter in the save_supplier function of /ajax.php?action=save_supplier. The flaw enables unauthorized manipulation of the backend database. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability is publicly disclosed with exploit code available, but no official fix or mitigation has been documented.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited by the medium severity score and the requirement of low privileges. There is no indication of system compromise beyond database manipulation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint and validate or sanitize inputs to the save_supplier function to mitigate SQL injection risks.