A SQL injection vulnerability has been discovered in SourceCodester Pharmacy Sales and Inventory System version 1.0. The flaw exists in the /ajax.php file's delete_customer action, where the ID parameter can be manipulated to perform SQL injection attacks. The vulnerability can be exploited remotely and a public exploit has been published, making it actively exploitable. This affects the customer deletion functionality of the pharmacy management system.