CVE-2026-7392

Vulnerability

A SQL injection vulnerability exists in the delete_supplier function of the SourceCodester Pharmacy Sales and Inventory System version 1.0. The flaw occurs in the /ajax.php?action=delete_supplier endpoint where the id parameter is directly concatenated into SQL queries without sanitization [1].

Exploitation

An unauthenticated attacker can exploit this vulnerability remotely by sending a crafted POST request with a malicious id parameter. No prior authentication or special network position is required [1].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands, potentially leading to unauthorized database access, data leakage, data modification, and full control of the database server, which could compromise the entire application [1].

Mitigation

As of the publication date, no official patch has been released. Users are advised to implement input validation or switch to parameterized queries to prevent SQL injection. The vendor's site provides the source code, but no fix is available [1]. The exploit details have been publicly disclosed, increasing the risk of active attacks.