Simple Pharmacy CVE-2026-104613

Exploitation requires an authenticated session with at least low-level privileges (CVSS PR:L) to reach the /SimplePharmacy-PHP/product/view.php endpoint, which then passes an unsanitized ID parameter into a SQL query. No user interaction is required (UI:N) and the attack is remote over the network (AV:N) with low complexity (AC:L). The primary limiting factors are the authentication requirement and the product's extremely limited deployment; no non-default configuration is needed once a valid account exists.

This is a low-to-moderate priority issue despite being a SQL injection flaw. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, base 5.3) indicates a network-reachable, low-complexity attack requiring low-level privileges (PR:L) with only limited confidentiality, integrity, and availability impact on the vulnerable system. A public exploit exists (publicly available exploit code exists), which raises practical risk, but there is no CISA KEV listing and no EPSS score provided, so there is no evidence of widespread or automated exploitation at this time. The 'E:P' (Proof-of-Concept exploit maturity) in the vector is consistent with the POC reference rather than confirmed in-the-wild use. The most important mitigating factor is prevalence: CodeAstro Simple Pharmacy Management System is a small tutorial/source-code PHP project with negligible enterprise footprint, so real-world exposure is minimal. Note a tension in the signals: SQL injection on an unsanitized ID parameter frequently permits full database read (which would justify higher confidentiality impact than the vendor's VC:L) - VulDB auto-generated scores tend to be conservative, so the real confidentiality impact may be understated; verify against the actual query context.

An attacker with a low-privilege authenticated account (PR:L) sends a crafted value in the ID parameter to /SimplePharmacy-PHP/product/view.php, injecting SQL that the application concatenates directly into a query. Because publicly available exploit code exists (referenced via the GitHub issue), an attacker can replicate the technique to enumerate or extract database contents such as patient/product or user records remotely. Low attack complexity means no special timing or configuration is needed beyond having a valid session.