Which versions of Pharmacy Sales and Inventory System are affected by CVE-2026-7088?

SourceCodester Pharmacy Sales and Inventory System version 1.0 contains an unauthenticated SQL injection vulnerability in the receiving module that allows remote attackers to compromise database…

Is there a public PoC exploit available for CVE-2026-7088?

Yes, a public proof-of-concept exploit is available for CVE-2026-7088. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7088?

Within 24 hours: Isolate or restrict network access to all instances of SourceCodester Pharmacy Sales and Inventory System 1.0 to trusted internal networks only; inventory all deployments and document affected patient data scope. Within 7 days: Contact vendor SourceCodester for patched version availability; evaluate migration to supported pharmacy management software with active security maintenance. Within 30 days: Execute migration plan or implement production deployment of patched version if available; conduct database integrity audit and review access logs for exploitation evidence.

Pharmacy Sales and Inventory System CVE-2026-7088

Q: What is the CVSS score of CVE-2026-7088?

CVE-2026-7088 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25772 MEDIUM

SQL Injection (CWE-89)

2026-04-27 VulDB

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 27, 2026 - 06:22 NVD

HIGH MEDIUM

CVSS changed

Apr 27, 2026 - 06:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 27, 2026 - 06:00 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 05:45 euvd

EUVD-2026-25772

Analysis Generated

Apr 27, 2026 - 05:45 vuln.today

CVE Published

Apr 27, 2026 - 04:45 nvd

MEDIUM 5.5

DescriptionCVE.org

A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0. The affected element is an unknown function of the file /ajax.php?action=save_receiving. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in /ajax.php?action=save_receiving. Publicly available exploit code (GitHub PoC) enables immediate weaponization. CVSS 7.3 reflects network-accessible attack with no authentication required, enabling confidentiality/integrity/availability impact across database operations. EPSS data not provided, but public exploit availability significantly elevates real-world risk for unpatched installations of this open-source PHP application.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP-based web application. The affected endpoint /ajax.php processes AJAX requests with an action parameter set to 'save_receiving', commonly used for inventory receiving operations in pharmacy management workflows. The vulnerability exists in server-side SQL query construction where user-supplied input from the 'ID' parameter is incorporated without proper sanitization, parameterization, or escaping. Attackers can inject malicious SQL syntax to manipulate database queries, potentially breaking out of intended WHERE clauses or appending additional SQL commands. The CPE identifies SourceCodester Pharmacy Sales and Inventory System as the affected product-a freely available PHP application likely built for educational or small business purposes without enterprise-grade input validation controls.

RemediationAI

No vendor-released patch identified at time of analysis (CVSS RL:X indicates unavailable remediation). Primary mitigation: immediately implement prepared statements or parameterized queries for all database interactions in /ajax.php, specifically for the 'save_receiving' action handler processing the ID parameter-this eliminates root cause by separating SQL logic from user data. Secondary urgent control: implement allowlist input validation restricting ID parameter to positive integers only (e.g., PHP filter_var with FILTER_VALIDATE_INT), rejecting requests with non-numeric values before database interaction. Compensating network controls with trade-offs: (1) restrict /ajax.php access to authenticated admin sessions only via PHP session validation-breaks unauthenticated API workflows if intended; (2) deploy web application firewall (WAF) with SQL injection signatures targeting common patterns (UNION, OR 1=1, comment sequences)-generates false positives for legitimate queries containing SQL keywords; (3) apply IP allowlisting for admin endpoints-prevents remote administration and breaks distributed usage scenarios. For production systems, consider migrating to actively maintained alternatives given SourceCodester's educational codebase focus. Monitor database logs for anomalous query patterns (multiple statements, UNION clauses, information_schema access) as detective control.