CVE-2026-7549: Pharmacy Sales & Inventory SQL Injection

CVE-2026-7549 Overview

CVE-2026-7549 is a SQL injection vulnerability affecting SourceCodester Pharmacy Sales and Inventory System 1.0. The flaw resides in the /ajax.php?action=delete_customer endpoint, where the ID parameter is passed to a database query without proper sanitization. Remote attackers can manipulate the ID argument to inject arbitrary SQL statements. A public exploit has been disclosed, increasing the likelihood of opportunistic attacks against exposed deployments. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Unauthenticated remote attackers can inject SQL through the delete_customer action, exposing or corrupting pharmacy customer records and supporting database content.

Affected Products

• SourceCodester Pharmacy Sales and Inventory System 1.0
• Deployments exposing /ajax.php?action=delete_customer to untrusted networks
• Web environments running the unpatched PHP/MySQL backend distributed by SourceCodester

Discovery Timeline

• 2026-05-01 - CVE-2026-7549 published to NVD
• 2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-7549

Vulnerability Analysis

The vulnerability exists in the delete_customer action handler within ajax.php. The endpoint accepts an ID parameter from the HTTP request and concatenates it directly into a SQL DELETE statement. Because the application performs no input validation, type casting, or parameterized binding, attacker-controlled values become part of the executed SQL syntax.

An attacker can issue a crafted HTTP request to /ajax.php?action=delete_customer containing SQL metacharacters in the ID field. Common exploitation techniques include boolean-based and time-based blind SQL injection, as well as UNION SELECT payloads to extract data from adjacent tables. Successful exploitation can disclose customer information, modify inventory records, or destroy data.

Root Cause

The root cause is unsanitized user input flowing into a SQL query string. The delete_customer handler trusts the ID parameter and does not use prepared statements or parameter binding. This is a classic injection pattern where data and code share the same context [CWE-74].

Attack Vector

The attack is performed remotely over the network and requires no authentication or user interaction. An attacker only needs HTTP access to the application. The published proof-of-concept lowers the technical barrier and enables script-based, automated exploitation.

No verified exploit code is available for inclusion. Refer to the VulDB Vulnerability Details and the GitHub Issue Discussion for technical specifics.

Detection Methods for CVE-2026-7549

Indicators of Compromise

• HTTP requests to /ajax.php?action=delete_customer containing SQL metacharacters such as ', --, UNION, SLEEP(, or OR 1=1 in the ID parameter.
• Web server logs showing repeated delete_customer requests from a single source within a short time window.
• Database errors or anomalous DELETE and SELECT statements originating from the application's database account.

Detection Strategies

• Deploy web application firewall rules that flag SQL injection signatures targeting the ID parameter on ajax.php endpoints.
• Enable verbose query logging on the backend MySQL instance and alert on syntactically malformed or unusually long DELETE statements.
• Correlate web access logs with database audit logs to identify request-to-query anomalies tied to the delete_customer action.

Monitoring Recommendations

• Monitor outbound traffic from the application server for unexpected data egress that may indicate exfiltration via UNION-based injection.
• Track HTTP 500 responses and database error rates from ajax.php as a leading indicator of injection probing.
• Establish baselines for normal delete_customer request volumes and alert on deviations.

How to Mitigate CVE-2026-7549

Immediate Actions Required

• Restrict access to the Pharmacy Sales and Inventory System to trusted networks or place it behind a VPN until a fix is applied.
• Deploy WAF signatures that block SQL metacharacters in the ID parameter of /ajax.php?action=delete_customer.
• Review database and web server logs for prior exploitation attempts referencing delete_customer.

Patch Information

No official vendor patch has been published for SourceCodester Pharmacy Sales and Inventory System 1.0 at the time of disclosure. Administrators should monitor the SourceCodester Security Resource for updates and consult the VulDB CTI Information for tracking advisories.

Workarounds

• Modify ajax.php to cast the ID parameter to an integer (intval($_REQUEST['ID'])) before using it in any SQL statement.
• Replace dynamic query construction with parameterized prepared statements using PDO or MySQLi bindings.
• Enforce least-privilege database accounts so the web application cannot execute schema modifications or access tables outside its scope.
• Disable or remove the delete_customer action if it is not required in production deployments.

# Configuration example: minimal ModSecurity rule blocking obvious SQLi on delete_customer
SecRule REQUEST_URI "@contains /ajax.php" \
  "chain,deny,status:403,id:1026754901,msg:'Possible SQLi on delete_customer (CVE-2026-7549)'"
  SecRule ARGS:ID "@rx (?i)(union(\s)+select|sleep\(|or\s+1=1|--|;)" "t:none,t:urlDecode"