This vulnerability involves an SQL injection flaw in SourceCodester Pharmacy Sales and Inventory System 1.0, specifically in the /ajax.php?action=delete_customer function. An attacker can manipulate the ID argument to inject SQL commands, potentially compromising the backend database. The vulnerability is remotely exploitable without requiring privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating medium severity. No official patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited by the lack of detailed information on the database schema or specific data exposure. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint, applying web application firewall (WAF) rules to detect and block SQL injection attempts, and reviewing application input validation controls for the affected parameter.