Attack Chain

1. The attacker identifies an instance of SourceCodester Pharmacy Sales and Inventory System 1.0.
2. The attacker crafts a malicious HTTP GET request targeting the /ajax.php?action=chk_prod_availability endpoint.
3. The attacker injects SQL code into the ID parameter of the request.
4. The vulnerable application processes the attacker-supplied SQL code without proper sanitization or validation.
5. The injected SQL code is executed against the application's database.
6. The attacker retrieves sensitive information from the database, such as user credentials, financial data, or inventory details.
7. The attacker uses the obtained credentials to gain unauthorized access to the application or the underlying system.

Impact

Successful exploitation of this vulnerability can lead to complete database compromise, potentially exposing sensitive patient data, financial records, and proprietary business information. The vulnerability affects all installations of SourceCodester Pharmacy Sales and Inventory System 1.0 that have not been patched. Given the nature of the software, successful attacks could lead to significant financial losses, reputational damage, and regulatory penalties.

Recommendation

• Apply the patch or upgrade to a secure version of SourceCodester Pharmacy Sales and Inventory System to remediate CVE-2026-6187.
• Implement the Sigma rule Detect SQL Injection Attempt to identify potential exploitation attempts in web server logs.
• Monitor web server logs for suspicious requests targeting the /ajax.php?action=chk_prod_availability endpoint, specifically looking for unusual characters or SQL keywords in the ID parameter.