A SQL injection vulnerability has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0. The vulnerability exists in the /ajax.php file with the save_receiving action, where manipulation of the ID argument leads to SQL injection. The attack can be launched remotely and exploits have been made publicly available. This represents a high-risk vulnerability due to the public availability of exploits and remote attack capability.