Executive brief
A security vulnerability exists in the SourceCodester Pharmacy Sales and Inventory System, a web application used for managing pharmaceutical stock and sales. An attacker can exploit this flaw to gain unauthorized access to the underlying database without needing a username or password. This could lead to the theft of sensitive business data, unauthorized modification of inventory records, or a complete disruption of the pharmacy's operations.
Technical details
A SQL injection vulnerability exists in SourceCodester Pharmacy Sales and Inventory System 1.0 within the '/ajax.php?action=delete_product' endpoint. The root cause is the improper neutralization of the 'id' parameter before its use in a database query. A remote, unauthenticated attacker can send a specially crafted POST request containing malicious SQL commands (such as boolean-based blind payloads) to manipulate database queries. This allows for unauthorized data extraction, modification, or deletion. A public exploit (PoC) using sqlmap has been disclosed. No official patch is currently documented; users are advised to implement prepared statements and input validation.
Affected products
- SourceCodester Pharmacy Sales and Inventory System 1.0
Timeline
- 2026-04-09: disclosed: Initial disclosure on GitHub by user zzb1388
- 2026-04-27: advisory: VulDB advisory published
- 2026-04-28: advisory: NVD published date