This vulnerability exists in SourceCodester Pharmacy Sales and Inventory System 1.0 within the delete_supplier function of /ajax.php?action=delete_supplier. By manipulating the ID argument, an attacker can inject SQL commands remotely, potentially compromising the database. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No official fix or patch has been published as of the data provided.

Successful exploitation allows remote attackers to execute arbitrary SQL commands via the ID parameter in the delete_supplier function, which may lead to unauthorized data access or modification in the backend database. The vulnerability is exploitable without user interaction and requires no privileges, increasing its risk. However, the impact is rated medium severity based on the CVSS score and vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the ID parameter to mitigate SQL injection risks. Monitoring for unusual database activity related to supplier deletion requests may also help detect exploitation attempts.