Which versions of Pharmacy Sales and Inventory System are affected by CVE-2026-7087?

SourceCodester Pharmacy Sales and Inventory System 1.0 contains a critical SQL injection vulnerability in its sales endpoint that allows unauthenticated attackers to read, modify, or delete pharmacy…

Is there a public PoC exploit available for CVE-2026-7087?

Yes, a public proof-of-concept exploit is available for CVE-2026-7087. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7087?

Within 24 hours: Inventory all instances of SourceCodester Pharmacy Sales and Inventory System 1.0 in production and development; isolate or disable the /ajax.php?action=save_sales endpoint if operationally feasible. Within 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection patterns in the ID parameter; conduct database access audit logs for unauthorized queries; contact vendor for patch timeline and interim security updates. Within 30 days: Migrate to a patched version of the application or replace with a supported pharmacy management system; perform forensic review of database logs for evidence of exploitation since vulnerability disclosure.

Pharmacy Sales and Inventory System CVE-2026-7087

Q: What is the CVSS score of CVE-2026-7087?

CVE-2026-7087 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25771 MEDIUM

SQL Injection (CWE-89)

2026-04-27 VulDB

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 27, 2026 - 06:22 NVD

HIGH MEDIUM

CVSS changed

Apr 27, 2026 - 06:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 27, 2026 - 06:00 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 05:45 euvd

EUVD-2026-25771

Analysis Generated

Apr 27, 2026 - 05:45 vuln.today

CVE Published

Apr 27, 2026 - 04:30 nvd

MEDIUM 5.5

DescriptionCVE.org

A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_sales. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to extract, modify, or delete database contents via the ID parameter in /ajax.php?action=save_sales endpoint. Publicly available exploit code exists (GitHub POC), enabling low-complexity attacks with no authentication barriers. EPSS data not available, but public exploit significantly lowers attacker skill threshold. CVSS 7.3 reflects network-exploitable vulnerability with moderate confidentiality, integrity, and availability impacts.

Technical ContextAI

This is a SQL injection vulnerability (CWE-89) in a PHP-based web application. The affected component is the /ajax.php endpoint with action parameter set to save_sales, where the ID parameter is directly incorporated into SQL queries without proper sanitization or parameterized statements. SQL injection occurs when user-controlled input is concatenated into SQL commands, allowing attackers to break out of the intended query logic and execute arbitrary SQL statements. The CPE identifier cpe:2.3:a:sourcecodester:pharmacy_sales_and_inventory_system:*:*:*:*:*:*:*:* indicates this affects SourceCodester's freely distributed code, commonly used by small pharmacies or for educational purposes. The PHP tag suggests the application uses direct SQL query construction rather than modern ORM frameworks or prepared statements that would mitigate this vulnerability class.

RemediationAI

Immediate action: Replace vulnerable version 1.0 with a patched release if available by checking https://www.sourcecodester.com/ and https://vuldb.com/vuln/359662 for updates. However, no vendor-released patch has been independently confirmed at time of analysis. Compensating controls: (1) Implement Web Application Firewall (WAF) rules to block SQL metacharacters in the ID parameter for /ajax.php requests - test thoroughly as this may break legitimate numeric ID values containing special characters; (2) Restrict network access to /ajax.php endpoints to authenticated internal users only via .htaccess or web server configuration - this breaks the unauthenticated remote vector (PR:N→PR:L/H) but may disrupt legitimate AJAX functionality if the application requires unauthenticated access; (3) Apply input validation at the application layer by modifying /ajax.php to enforce integer-only ID values using PHP intval() or prepared statements with parameterized queries - requires source code modification expertise. Workaround trade-off: WAF rules may cause false positives; authentication requirements may break application workflows; code changes require PHP development skills and testing. Long-term: Migrate to a maintained, security-patched pharmacy management system, as SourceCodester projects are often educational code without enterprise security support.