SourceCodester Pharmacy Sales and Inventory System CVE-2026-7283

Q: What is the CVSS score of CVE-2026-7283?

CVE-2026-7283 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26066 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-04-28 cna@vuldb.com

PHP SQLi

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.1 (MEDIUM) 2.0 (LOW)

Analysis Generated

Apr 28, 2026 - 15:30 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 15:22 euvd

EUVD-2026-26066

Analysis Generated

Apr 28, 2026 - 15:22 vuln.today

CVE Published

Apr 28, 2026 - 15:16 nvd

LOW 2.0

DescriptionCVE.org

A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts the function save_expired of the file /ajax.php?action=save_expired. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the ID parameter in the save_expired function of /ajax.php. The vulnerability affects an administrative interface endpoint and has publicly available exploit code. CVSS 5.1 reflects low confidentiality, integrity, and availability impact despite network accessibility due to high-privilege requirement (PR:H).

Technical ContextAI

The vulnerability stems from improper input validation in a PHP application endpoint (/ajax.php?action=save_expired) that processes user-supplied ID parameters without parameterized queries or prepared statements. This represents CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), a variant of SQL injection where user input reaches database query construction. The application appears to be a PHP-based web application managing pharmacy inventory and sales operations, typical of small-business management systems built on unvetted frameworks or legacy code patterns without modern security libraries.

RemediationAI

Immediate remediation requires applying parameterized queries (prepared statements) to all database operations in /ajax.php, specifically the save_expired function handling the ID parameter. SourceCodester should release a patched version (no specific version number currently available from vendor). Until an official patch is available, compensating controls include: (1) Restrict network access to /ajax.php endpoints via Web Application Firewall rules blocking requests with suspicious SQL syntax in the ID parameter (e.g., quotes, SQL keywords); (2) Enforce strong authentication and multi-factor authentication for administrative accounts to limit PR:H exploitation scenarios; (3) Implement database-level access controls restricting the application user account to read-only permissions on non-critical tables and write access only to intended tables. Monitor the vendor's website (https://www.sourcecodester.com/) and VulDB submission (https://vuldb.com/submit/803019) for official patches. If you are the vendor, apply input validation using parameterized SQL statements immediately and publish a security advisory with a patched version number.