An unauthenticated SQL injection vulnerability in Phpscriptsmall Advance Gift Shop Pro Script 2.0.3 allows remote attackers to compromise database integrity and confidentiality.

The application fails to properly sanitize user input supplied to the 's' parameter during search requests. This flaw permits unauthenticated attackers to inject malicious SQL commands, enabling unauthorized access to the underlying database structure and content.

Successful exploitation of this vulnerability can result in the full disclosure of sensitive database information, including administrative credentials and proprietary shop data. Given the CVSS score of 8.2, this represents a high-severity risk that could lead to complete database compromise, potential loss of customer data, and significant reputational damage.

Immediate Action: Since no official patch is currently identified, administrators should restrict access to the affected search functionality or place the application behind a robust Web Application Firewall (WAF) configured to block SQL injection patterns.

Proactive Monitoring: Review web server and database logs for suspicious search queries containing SQL syntax, such as UNION, SELECT, or sleep commands, which may indicate active exploitation attempts.

Compensating Controls: Implement strict input validation and parameterized queries at the application layer to neutralize malicious payloads, and ensure the database user account has the minimum privileges necessary for operation.

Public Exploit Available: Yes, a published proof-of-concept exists via the Exploit-DB entry 46457.

Due to the ease of exploitation and the potential for total database compromise, organizations using this software must prioritize mitigation. If a vendor update is unavailable, disabling the vulnerable search feature or deploying a WAF is essential to protect the environment from unauthorized data exfiltration.