CVE-2026-7391

Vulnerability

Description

A SQL injection vulnerability exists in SourceCodester Pharmacy Sales and Inventory System 1.0 within the /ajax.php?action=save_supplier endpoint. The root cause is insufficient validation of the id parameter, which is directly concatenated into SQL queries without sanitization [1]. This allows an attacker to inject malicious SQL code.

Exploitation

The vulnerability can be exploited remotely without authentication. An attacker sends a crafted POST request with a malicious id parameter in multipart form data. The exploit is publicly available, including proof-of-concept payloads [1].

Impact

Successful exploitation enables an attacker to perform unauthorized database operations, including reading, modifying, or deleting data, gaining access to sensitive information, and potentially achieving full system control. This can lead to data breaches, data tampering, and service disruption [1].

Mitigation

As of the publication date, no official patch has been released by the vendor. Users are advised to apply input validation and parameterized queries to mitigate the risk. Given the public availability of exploit code, immediate action is recommended.