This vulnerability affects SourceCodester Pharmacy Sales and Inventory System 1.0. It arises from improper sanitization of the ID parameter in the /ajax.php?action=save_user script, enabling remote attackers to inject SQL commands. The vulnerability is remotely exploitable without authentication and has a medium severity rating based on CVSS 4.0 metrics. No vendor advisory or patch information is provided, and the exploit details have been made public.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability does not require user interaction or privileges, increasing its risk. However, the CVSS vector indicates limited confidentiality, integrity, and availability impacts, consistent with medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as temporary mitigations. Monitoring for unusual database activity may also help detect exploitation attempts.