SQL Injection Vulnerability in SourceCodester Pharmacy Sales and Inventory System
CVE-2026-7194

6.9MEDIUM

Key Information:

Vendor: Sourcecodester
Status: Pharmacy Sales And Inventory System
Vendor: CVE Published:; 27 April 2026

🔔 Create Sourcecodester Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-7194?

A security weakness has been discovered in the SourceCodester Pharmacy Sales and Inventory System 1.0, specifically within the file /ajax.php when processing the action save_product. This vulnerability allows attackers to manipulate the argument ID, leading to SQL injection. The flaw can be exploited remotely, meaning that attackers do not need physical access to the system to launch an attack. This vulnerability poses a significant risk to the integrity and confidentiality of the application's database, as public exploit code has been made available, increasing the potential for malicious activities.

Affected Version(s)

Pharmacy Sales and Inventory System 1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-7194 - Proof of Concept