Good find.<p>Since it is not a Web App and hence not publicly available to exploit:<p>Use of String.Format instead Parameterized queries is how Sql injection issues sneak in. (Line 63, <a href="https:&#x2F;&#x2F;github.com&#x2F;katway&#x2F;DrugSupervision&#x2F;blob&#x2F;GuiDesign&#x2F;DrugSupervise&#x2F;ScannerForm.cs" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;katway&#x2F;DrugSupervision&#x2F;blob&#x2F;GuiDesign&#x2F;Dru...</a>)