An unauthenticated SQL injection vulnerability in Wecodex Restaurant CMS version 1.0 poses a critical risk of database compromise and unauthorized information disclosure.

The application fails to properly sanitize user input within the username parameter of the login endpoint. This allows unauthenticated attackers to execute arbitrary SQL commands using blind injection techniques to extract data from the underlying database.

The ability for an unauthenticated attacker to inject SQL commands into the database can lead to the full exposure of sensitive application data, including user credentials and administrative information. Given the CVSS score of 8.2, this vulnerability represents a high risk that could lead to significant data breaches, loss of customer trust, and potential regulatory non-compliance.

Immediate Action: As no official patch is currently available, administrators should restrict access to the administrative login interface using network-level controls or IP allowlisting until the vendor provides a remediation.

Proactive Monitoring: Security teams should review web server access logs for anomalous POST requests to the login endpoint, particularly those containing SQL syntax or unusual characters, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns directed at the identified login endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists via the Exploit-DB entry 44730.

Due to the lack of an official patch and the availability of public exploit material, this vulnerability presents an elevated and persistent risk. Organizations utilizing Wecodex Restaurant CMS version 1.0 must prioritize isolating the affected application from public exposure and implementing robust WAF filtering to prevent unauthorized database access.