Executive brief
A security vulnerability exists in the SourceCodester Pharmacy Sales and Inventory System, a software used for managing pharmaceutical stock and sales. An attacker can exploit this flaw to gain unauthorized access to the underlying database without needing a username or password. This could lead to the theft of sensitive business data, tampering with inventory records, or disruption of pharmacy operations.
Technical details
A SQL injection vulnerability exists in SourceCodester Pharmacy Sales and Inventory System 1.0 within the '/ajax.php?action=chk_prod_availability' endpoint. The root cause is the failure to properly sanitize or validate the 'id' parameter before using it in a database query. A remote, unauthenticated attacker can send a specially crafted POST request containing malicious SQL commands (such as boolean-based blind payloads) to manipulate queries. Successful exploitation allows for unauthorized database access, data exfiltration, and potential modification of system records. A public exploit (PoC) using sqlmap has been disclosed.
Affected products
- SourceCodester Pharmacy Sales and Inventory System 1.0
Timeline
- 2026-04-05: disclosed: Vulnerability details and PoC shared on GitHub by user zzb1388.
- 2026-04-13: advisory: CVE-2026-6187 published.