This vulnerability involves an SQL injection flaw in the SourceCodester Pharmacy Sales and Inventory System 1.0, specifically in the /ajax.php?action=delete_customer functionality. By manipulating the ID argument, an attacker can inject SQL commands remotely without requiring privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating a medium severity risk. No official patch or vendor remediation has been documented, and the product is not a cloud service, so remediation depends on the vendor or user applying fixes. Exploit code is publicly available, increasing the risk of potential attacks.

Successful exploitation allows an unauthenticated remote attacker to perform SQL injection, potentially leading to unauthorized data access or modification within the affected system. The vulnerability impacts confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. No confirmed exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable endpoint, implement web application firewalls with SQL injection detection, and monitor for suspicious activity related to the /ajax.php?action=delete_customer parameter. Avoid exposing the affected system directly to untrusted networks if possible.