Which versions of PHP are affected by CVE-2026-6189?

SourceCodester Pharmacy Sales and Inventory System 1.0 contains an unauthenticated SQL injection vulnerability in the login function that allows attackers to directly access, modify, or delete…

Is there a public PoC exploit available for CVE-2026-6189?

Yes, a public proof-of-concept exploit is available for CVE-2026-6189. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6189?

Within 24 hours: Identify all instances of SourceCodester Pharmacy Sales and Inventory System 1.0 in production and isolate affected systems from external networks if operationally feasible. Within 7 days: Implement Web Application Firewall (WAF) rules blocking SQL injection patterns in the /ajax.php?action=login endpoint; apply input validation and parameterized queries if internal development resources are available. Within 30 days: Migrate to a patched or alternative pharmacy management system; conduct forensic audit of database logs for unauthorized access or modification since deployment.

PHP CVE-2026-6189

Q: What is the CVSS score of CVE-2026-6189?

CVE-2026-6189 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-22016 MEDIUM

SQL Injection (CWE-89)

2026-04-13 VulDB

GHSA-f7v4-47q7-f3fq

PHP SQLi Pharmacy Sales And Inventory System Sourcecodester

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 13, 2026 - 17:22 NVD

HIGH MEDIUM

CVSS changed

Apr 13, 2026 - 17:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 13, 2026 - 17:14 vuln.today

EUVD ID Assigned

Apr 13, 2026 - 16:45 euvd

EUVD-2026-22016

Analysis Generated

Apr 13, 2026 - 16:45 vuln.today

CVE Published

Apr 13, 2026 - 16:00 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. The affected element is an unknown function of the file /ajax.php?action=login. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the Username parameter in /ajax.php?action=login. The vulnerability enables low-complexity attacks requiring no user interaction, with publicly available exploit code (EPSS probability data not provided, not listed in CISA KEV). Attackers can compromise confidentiality, integrity, and availability of the pharmacy inventory database without authentication.

Technical ContextAI

This vulnerability affects the authentication handler in SourceCodester's Pharmacy Sales and Inventory System version 1.0, a PHP-based web application for managing pharmacy operations. The flaw exists in the /ajax.php endpoint's login action handler, which fails to properly sanitize or parameterize the Username input before incorporating it into SQL queries. This is a classic CWE-89 (SQL Injection) vulnerability where unsanitized user input is concatenated directly into SQL statements. Based on the CPE string (cpe:2.3:a:sourcecodester:pharmacy_sales_and_inventory_system:*:*:*:*:*:*:*:*), this affects the SourceCodester-distributed version of the application. The login endpoint processes authentication requests via AJAX, likely using a backend database (MySQL/MariaDB typical for PHP applications) to verify credentials. The lack of prepared statements or input validation allows attackers to break out of the intended SQL query structure and execute arbitrary SQL commands.

RemediationAI

No vendor-released patch identified at time of analysis. Organizations currently running SourceCodester Pharmacy Sales and Inventory System 1.0 should immediately implement defense-in-depth measures since an official fix version is not confirmed. Primary remediation steps include: replace vulnerable authentication code in /ajax.php with parameterized prepared statements using PDO or MySQLi prepared statement APIs to prevent SQL injection; implement strict input validation and sanitization on the Username parameter using allowlists for acceptable characters; deploy a web application firewall (WAF) with SQL injection detection rules to block exploitation attempts targeting the /ajax.php?action=login endpoint; restrict network access to the application to trusted IP ranges if feasible; conduct security audit of the entire codebase as similar injection flaws may exist in other endpoints; monitor database query logs and web server access logs for suspicious patterns matching the public exploit (github.com/lingzezzz/lingze/issues/1). For production environments handling sensitive pharmacy data, consider replacing this application with a commercially supported or actively maintained alternative given the absence of vendor security response. Additional vulnerability details and threat intelligence available at vuldb.com/vuln/357111 and vuldb.com/vuln/357111/cti.