Which versions of Pharmacy Sales and Inventory System are affected by CVE-2026-7549?

SourceCodester Pharmacy Sales and Inventory System 1.0 contains an unauthenticated SQL injection vulnerability that allows attackers to extract, modify, or delete pharmacy data without credentials.

Is there a public PoC exploit available for CVE-2026-7549?

Yes, a public proof-of-concept exploit is available for CVE-2026-7549. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7549?

Within 24 hours: Identify all instances of SourceCodester Pharmacy Sales and Inventory System 1.0 in production via network scanning and asset management systems; isolate or take offline any exposed instances. Within 7 days: Implement network-level access controls (WAF rules blocking /ajax.php?action=delete_customer, IP whitelisting, or reverse proxy authentication) as interim protection; audit database access logs for suspicious activity. Within 30 days: Migrate to a patched pharmacy management system or a maintained alternative; document any compromised data and initiate breach notification if customer/patient data was accessed.

Pharmacy Sales and Inventory System CVE-2026-7549

Q: What is the CVSS score of CVE-2026-7549?

CVE-2026-7549 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26475 MEDIUM

SQL Injection (CWE-89)

2026-05-01 VulDB

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

May 01, 2026 - 15:26 vuln.today

Public exploit code

Severity Changed

May 01, 2026 - 05:22 NVD

HIGH MEDIUM

CVSS changed

May 01, 2026 - 05:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

May 01, 2026 - 05:15 vuln.today

EUVD ID Assigned

May 01, 2026 - 05:00 euvd

EUVD-2026-26475

Analysis Generated

May 01, 2026 - 05:00 vuln.today

CVE Published

May 01, 2026 - 03:30 nvd

MEDIUM 5.5

DescriptionCVE.org

A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=delete_customer. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.

AnalysisAI

SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to extract database contents, modify records, or execute unauthorized queries via the ID parameter in /ajax.php?action=delete_customer. Publicly available exploit code exists (GitHub POC), enabling trivial exploitation against exposed instances. CVSS 7.3 reflects network-accessible attack with low complexity and no authentication requirement, though EPSS data unavailable and not currently listed in CISA KEV, suggesting limited widespread exploitation despite POC availability.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP-based web application. The affected file /ajax.php implements a customer deletion function that accepts an ID parameter without proper input validation or parameterized query preparation. According to CPE data (cpe:2.3:a:sourcecodester:pharmacy_sales_and_inventory_system), the vulnerability exists in SourceCodester's Pharmacy Sales and Inventory System version 1.0, a free open-source PHP application for managing pharmacy operations. SQL injection occurs when user-controlled input is concatenated directly into SQL statements, allowing attackers to inject malicious SQL commands. The AJAX endpoint pattern suggests this is part of the application's administrative interface for managing customer records.

RemediationAI

No vendor-released patch identified at time of analysis (CVSS RL:X indicates unknown remediation level). Primary mitigation requires manual code remediation: modify /ajax.php to use parameterized prepared statements for the delete_customer action, specifically binding the ID parameter instead of direct concatenation. For organizations unable to patch immediately, implement compensating controls: (1) Restrict /ajax.php access to authenticated admin users only via web application firewall or .htaccess rules, trading functionality for reduced attack surface; (2) Deploy web application firewall with SQL injection signature detection to block exploitation attempts, though this may cause false positives on legitimate queries; (3) Place application behind VPN or IP whitelist if used only by internal staff, eliminating remote attack vector entirely. GitHub POC at https://github.com/khairulazly760530-cell/cves/issues/3 can be used to validate patch effectiveness. VulDB references (https://vuldb.com/vuln/360359) provide additional technical details but no official vendor guidance.