Attack Chain

1. Attacker identifies the vulnerable endpoint: /ajax.php?action=save_user.
2. Attacker crafts a malicious SQL payload, injecting it into the ID parameter of the request.
3. The vulnerable application fails to properly sanitize the input provided by the attacker.
4. The application executes the crafted SQL query against the database.
5. The attacker gains the ability to read sensitive data from the database, such as user credentials, patient information, or inventory details.
6. The attacker modifies or deletes data within the database, potentially disrupting pharmacy operations or altering financial records.

Impact

Successful exploitation of this SQL injection vulnerability could lead to significant data breaches, including unauthorized access to sensitive patient information, financial records, and inventory data. This could result in regulatory fines, reputational damage, and disruption of pharmacy operations. Given the public availability of the exploit, organizations using SourceCodester Pharmacy Sales and Inventory System 1.0 are at increased risk.

Recommendation

• Deploy the Sigma rule Detect_Pharmacy_SQLi_Save_User to identify attempts to exploit the SQL injection vulnerability in the /ajax.php?action=save_user endpoint.
• Apply input validation and sanitization to the ID parameter in /ajax.php?action=save_user to prevent SQL injection, mitigating CVE-2026-8083.