Which versions of Pharmacy Sales and Inventory System are affected by CVE-2026-7127?

SourceCodester Pharmacy Sales and Inventory System 1.0 contains an unauthenticated SQL injection vulnerability in the receiving module that allows attackers to read, modify, or delete critical…

Is there a public PoC exploit available for CVE-2026-7127?

Yes, a public proof-of-concept exploit is available for CVE-2026-7127. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7127?

Within 24 hours: Identify and inventory all instances of SourceCodester Pharmacy Sales and Inventory System 1.0 in your environment and document network exposure. Restrict network access to the application using firewall rules-block external access to port(s) hosting the application, and limit to authorized users only via VPN or air-gap if internet access is required. Within 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection patterns targeting /ajax.php?action=delete_receiving parameter; monitor access logs for exploitation attempts. Within 30 days: Contact SourceCodester for patch timeline; evaluate migration to a supported pharmacy management system with current security patches, or conduct code review and custom remediation if vendor timeline is unacceptable.

Pharmacy Sales and Inventory System CVE-2026-7127

Q: What is the CVSS score of CVE-2026-7127?

CVE-2026-7127 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25851 MEDIUM

SQL Injection (CWE-89)

2026-04-27 VulDB

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 27, 2026 - 14:22 NVD

HIGH MEDIUM

CVSS changed

Apr 27, 2026 - 14:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 27, 2026 - 14:00 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 13:30 euvd

EUVD-2026-25851

Analysis Generated

Apr 27, 2026 - 13:30 vuln.today

CVE Published

Apr 27, 2026 - 13:16 nvd

MEDIUM 5.5

DescriptionCVE.org

A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /ajax.php?action=delete_receiving. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to read, modify, or delete database records via the ID parameter in /ajax.php?action=delete_receiving. Publicly available exploit code (GitHub POC) demonstrates working attack against default installations with no authentication required (CVSS AV:N/AC:L/PR:N). EPSS data not available, but POC publication significantly lowers exploitation barrier for opportunistic attacks against internet-exposed instances.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP-based web application. The /ajax.php endpoint handles AJAX requests for the 'delete_receiving' action, accepting an 'ID' parameter that is directly concatenated into SQL queries without proper sanitization or parameterized statements. SQL injection allows attackers to break out of the intended query context and execute arbitrary SQL commands against the backend database. The affected product is SourceCodester Pharmacy Sales and Inventory System version 1.0, a PHP application typically deployed with MySQL/MariaDB databases. The CPE string (cpe:2.3:a:sourcecodester:pharmacy_sales_and_inventory_system:*:*:*:*:*:*:*:*) confirms this is a vendor-specific application from the SourceCodester open-source repository, commonly used by small pharmacies or as educational code examples.

RemediationAI

No vendor-released patch identified at time of analysis-SourceCodester does not appear to maintain active security updates for legacy versions. Organizations must implement application-level fixes: modify /ajax.php to use parameterized SQL queries (prepared statements) for all ID parameter handling in the delete_receiving function, replacing string concatenation with PDO/MySQLi bound parameters (e.g., $stmt = $pdo->prepare('DELETE FROM receiving WHERE id = ?'); $stmt->execute([$id]);). As immediate compensating controls, implement web application firewall (WAF) rules to block SQL injection patterns in the ID parameter (single quotes, UNION keywords, comment sequences), though this may break legitimate functionality if ID values legitimately contain special characters. Restrict network access to /ajax.php to authenticated sessions only by adding session validation checks at the script entry point-this reduces attack surface from unauthenticated remote to authenticated remote. Long-term recommendation: migrate to maintained inventory management software with active security support, as this application appears abandoned. All compensating controls are bypassed if attackers gain valid session cookies, so patching the underlying code defect is critical.