CVE-2026-7550: Pharmacy Sales Inventory System SQL Injection

CVE-2026-7550 Overview

CVE-2026-7550 is a SQL injection vulnerability in SourceCodester Pharmacy Sales and Inventory System 1.0. The flaw resides in the /ajax.php?action=save_customer endpoint, where the ID parameter is not properly sanitized before being used in a database query. Attackers can manipulate the ID argument remotely to inject arbitrary SQL statements. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed installations. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Remote, unauthenticated attackers can inject SQL commands through the ID parameter in save_customer, exposing customer records and pharmacy inventory data.

Affected Products

• SourceCodester Pharmacy Sales and Inventory System 1.0
• Endpoint: /ajax.php?action=save_customer
• Vulnerable parameter: ID

Discovery Timeline

• 2026-05-01 - CVE-2026-7550 published to NVD
• 2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-7550

Vulnerability Analysis

The vulnerability exists in the customer save handler invoked through /ajax.php?action=save_customer. The application accepts an ID parameter from the HTTP request and concatenates it directly into a SQL statement without parameterization or input validation. An attacker can supply crafted input that breaks out of the intended query context and appends arbitrary SQL clauses.

Because the endpoint is reachable over the network and requires no authentication or user interaction, exploitation is straightforward. The CVSS 4.0 vector indicates limited impact on confidentiality, integrity, and availability of the vulnerable database, consistent with a typical SQL injection in a single-tenant PHP application. The EPSS score of 0.039% reflects a low current probability of mass exploitation, but public proof-of-concept disclosure raises that risk over time.

Root Cause

The root cause is improper neutralization of user-controlled input passed to the SQL interpreter. The save_customer action does not use prepared statements or bound parameters when handling the ID field. Standard PHP/MySQL hardening practices such as mysqli_prepare or PDO parameter binding are absent in the affected code path.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to /ajax.php?action=save_customer with a malicious payload in the ID parameter. Typical payloads include boolean-based, error-based, time-based, or UNION-based SQL injection strings. Successful exploitation enables data extraction, modification of customer and inventory records, and potential authentication bypass through manipulation of stored credentials. Technical details and a public proof-of-concept are referenced in the GitHub Issue Report and the VulDB #360360 entry.

Detection Methods for CVE-2026-7550

Indicators of Compromise

• HTTP requests to /ajax.php?action=save_customer containing SQL metacharacters such as ', --, UNION, SLEEP(, or OR 1=1 in the ID parameter.
• Web server access logs showing unusually long or URL-encoded ID values originating from a single source IP.
• Database error messages referencing save_customer queries or unexpected mysqli syntax errors in application logs.
• Anomalous read volume from the customers table or full-table scans triggered by injected UNION SELECT payloads.

Detection Strategies

• Deploy a web application firewall (WAF) rule set tuned to block SQL injection patterns targeting ajax.php query strings.
• Enable verbose query logging on the backend database and alert on parameterless queries containing concatenated metacharacters.
• Correlate access logs with database audit logs to identify request-to-query pairs that include attacker-controlled SQL fragments.

Monitoring Recommendations

• Monitor outbound traffic from the pharmacy application server for signs of data exfiltration following suspicious save_customer requests.
• Track failed login attempts and customer record modifications occurring shortly after anomalous ajax.php traffic.
• Establish a baseline of normal ID parameter values and alert on deviations such as non-numeric input or excessive length.

How to Mitigate CVE-2026-7550

Immediate Actions Required

• Restrict network access to the Pharmacy Sales and Inventory System until a vendor patch is applied, allowing only trusted internal IP ranges.
• Place the application behind a WAF and enable SQL injection signature enforcement for all ajax.php endpoints.
• Audit recent access logs for exploitation attempts against /ajax.php?action=save_customer and review database integrity.

Patch Information

No official vendor patch has been published at the time of writing. Refer to the SourceCodester Blog and the VulDB #360360 advisory for updates. Organizations running this software should track the vendor channel and apply fixes as soon as they are released.

Workarounds

• Modify the save_customer handler to use parameterized queries via PDO or mysqli_prepare with bound parameters for the ID field.
• Enforce strict server-side input validation, accepting only integer values for ID and rejecting any request containing SQL metacharacters.
• Apply the principle of least privilege to the database account used by the application, removing DROP, ALTER, and FILE privileges.
• Disable or remove unused AJAX actions in ajax.php to reduce the exposed attack surface.

# Example WAF rule (ModSecurity) to block SQLi against save_customer
SecRule REQUEST_URI "@contains /ajax.php" \
  "chain,id:1007550,phase:2,deny,status:403,msg:'CVE-2026-7550 SQLi attempt'"
  SecRule ARGS:action "@streq save_customer" "chain"
  SecRule ARGS:ID "@detectSQLi" "t:none,t:urlDecodeUni"