Which versions of Pharmacy Sales and Inventory System are affected by CVE-2026-7550?

SourceCodester Pharmacy Sales and Inventory System version 1.0 contains a critical SQL injection vulnerability in customer management functions that allows unauthenticated attackers to read, modify,…

Is there a public PoC exploit available for CVE-2026-7550?

Yes, a public proof-of-concept exploit is available for CVE-2026-7550. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7550?

Within 24 hours: identify all systems running SourceCodester Pharmacy Sales and Inventory System 1.0 and isolate them from external network access pending remediation. Within 7 days: evaluate migration to a patched or alternative pharmacy management solution-contact SourceCodester for vendor roadmap on security updates. Within 30 days: complete migration, implement input validation and parameterized queries if in-house remediation is attempted, and deploy web application firewall rules to block SQL injection patterns on /ajax.php endpoints.

Pharmacy Sales and Inventory System CVE-2026-7550

Q: What is the CVSS score of CVE-2026-7550?

CVE-2026-7550 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26476 MEDIUM

SQL Injection (CWE-89)

2026-05-01 VulDB

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

May 01, 2026 - 15:26 vuln.today

Public exploit code

Severity Changed

May 01, 2026 - 05:22 NVD

HIGH MEDIUM

CVSS changed

May 01, 2026 - 05:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

May 01, 2026 - 05:15 vuln.today

EUVD ID Assigned

May 01, 2026 - 05:00 euvd

EUVD-2026-26476

Analysis Generated

May 01, 2026 - 05:00 vuln.today

CVE Published

May 01, 2026 - 03:45 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected is an unknown function of the file /ajax.php?action=save_customer. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to read, modify, or delete database records via the ID parameter in /ajax.php?action=save_customer. CVSS 7.3 with low attack complexity and no authentication required. Publicly available exploit code exists (GitHub POC published), elevating immediate risk for exposed installations. EPSS data not available, but the combination of network vector, zero authentication, and public POC indicates high probability of opportunistic scanning and exploitation.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP-based web application. The affected endpoint /ajax.php with action=save_customer likely handles AJAX requests for customer data operations. The vulnerability stems from inadequate input validation and parameterization of the ID argument before incorporating it into SQL queries. SQL injection occurs when user-controlled input is concatenated directly into SQL statements rather than using prepared statements or proper escaping. The affected product, Pharmacy Sales and Inventory System by SourceCodester, is a downloadable open-source project commonly used for educational purposes or by small pharmacies. CPE string cpe:2.3:a:sourcecodester:pharmacy_sales_and_inventory_system identifies version 1.0 as vulnerable, though the wildcard version field suggests all current versions may be affected pending vendor clarification.

RemediationAI

No vendor-released patch identified at time of analysis. Organizations using this software must implement compensating controls immediately. Primary mitigation: apply input validation and parameterized queries to /ajax.php by modifying the save_customer action handler to use prepared statements (e.g., PDO with bound parameters or mysqli_prepare) instead of direct string concatenation of the ID parameter - this requires source code modification and testing to ensure customer save functionality remains intact. Secondary mitigation: restrict network access to /ajax.php to authenticated sessions only by adding authentication checks in the PHP handler or using web server access controls (e.g., Apache .htaccess with IP whitelisting or session validation) - trade-off is that legitimate unauthenticated AJAX calls will break if the application design expects them. Tertiary: deploy a web application firewall (WAF) with SQL injection signatures to block common payloads targeting the ID parameter - this is a detection-based control that may be bypassed with obfuscation but provides immediate defense-in-depth. Long-term: consider migrating to actively maintained pharmacy management software with a vendor security program. VulDB disclosure reference https://vuldb.com/vuln/360360 and exploit POC at https://github.com/khairulazly760530-cell/cves/issues/2 provide technical details for testing mitigations.