CVE-2026-7199: SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection
A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=deleteproduct. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7199?
CVE-2026-7199 is considered a high-severity SQL injection vulnerability that can lead to unauthorized data access.
How do I fix CVE-2026-7199?
To fix CVE-2026-7199, it's recommended to sanitize and validate all user inputs in the /ajax.php?action=delete_product functionality.
What systems are affected by CVE-2026-7199?
CVE-2026-7199 affects SourceCodester Pharmacy Sales and Inventory System version 1.0.
What kind of attack can be executed using CVE-2026-7199?
An attacker can execute SQL injection attacks through the vulnerable /ajax.php?action=delete_product endpoint.
Is there a patch available for CVE-2026-7199?
As of now, there is no publicly available patch for CVE-2026-7199, so immediate mitigation steps should be taken.