Executive brief
A vulnerability exists in the SourceCodester Pharmacy Sales and Inventory System, a web application used for managing pharmaceutical stock and sales. An attacker can exploit a flaw in the login process to gain unauthorized access to the underlying database. This could lead to the theft of sensitive business data, modification of inventory records, or a complete takeover of the system.
Technical details
A SQL injection vulnerability exists in SourceCodester Pharmacy Sales and Inventory System 1.0 within the '/ajax.php?action=login' endpoint. The root cause is the improper neutralization of special elements in the 'username' POST parameter, which is used directly in SQL queries without sufficient validation or prepared statements. A remote, unauthenticated attacker can exploit this by sending crafted SQL payloads (such as time-based blind injection) to manipulate database queries. Successful exploitation can lead to unauthorized database access, data exfiltration, and potential administrative bypass. A public exploit (PoC) has been disclosed.
Affected products
- SourceCodester Pharmacy Sales and Inventory System 1.0
Timeline
- 2026-04-05: disclosed: Vulnerability details and PoC shared on GitHub.
- 2026-04-13: advisory: CVE published and listed on NVD.