This vulnerability affects SourceCodester Web-based Pharmacy Product Management System 1.0. It arises from improper handling of the ID argument in the /product_expiry/edit-admin.php file, allowing an attacker to perform SQL injection attacks remotely. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability has been publicly disclosed with available exploits, but no official fix or patch has been documented.

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate backend database queries, potentially leading to unauthorized data access or modification. The vulnerability can be triggered remotely without authentication or user interaction, increasing the risk of exploitation. However, the impact is rated medium severity, indicating limited or partial impact on confidentiality, integrity, or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should monitor for vendor updates. Until a patch is available, consider restricting access to the affected functionality or applying web application firewall rules to detect and block SQL injection attempts targeting the ID parameter in /product_expiry/edit-admin.php.