The Online Shopping System Advanced 1.0 contains a critical SQL injection vulnerability that permits unauthenticated attackers to exfiltrate sensitive data from the backend database.

The application fails to properly sanitize user input in the cm parameter within the payment_success.php script, which allows for unauthorized SQL command execution. This flaw is accessible to unauthenticated remote attackers.

The ability to perform unauthorized SQL injection queries poses a severe risk to data confidentiality, potentially leading to the exposure of customer records, credentials, or other sensitive business intelligence. With a CVSS score of 7.5, this vulnerability represents a high-risk entry point that could facilitate full database compromise, resulting in significant regulatory and reputational damage.

Immediate Action: As no official patch is currently available, administrators should restrict access to the payment_success.php script or disable the affected module until a fix is provided by the vendor.

Proactive Monitoring: Security teams should monitor database logs for abnormal query patterns, specifically those containing SQL syntax characters or unexpected union-based select statements originating from the payment_success.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule designed to inspect and block incoming HTTP requests containing SQL injection payloads directed at the cm parameter.

Public Exploit Available: Yes, a public exploit exists via ExploitDB (ID 51811).

Given the availability of a public exploit and the ease of remote, unauthenticated access, this vulnerability must be addressed with high priority. Organizations using this software should implement stringent WAF filtering immediately and actively seek alternatives if the vendor does not provide a remediation path for the identified SQL injection flaw.