An unauthenticated SQL injection vulnerability in SourceCodester Pet Grooming Management Software 1.0 poses a critical risk of full database compromise and unauthorized data manipulation.

The application fails to properly sanitize the id parameter in the /admin/edit_role.php file, allowing an unauthenticated attacker to inject malicious SQL commands. This flaw supports various injection techniques including boolean-based blind, time-based blind, and stacked queries.

Successful exploitation of this vulnerability allows unauthorized actors to execute arbitrary SQL commands against the backend database. This can lead to the exfiltration of sensitive customer and administrative data, unauthorized modification of system records, or complete service disruption. Given the CVSS score of 7.3, this represents a significant risk to organizational data integrity and operational continuity.

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict network access to the /admin/edit_role.php endpoint to trusted internal networks only.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically looking for SQL syntax characters or time-based sleep commands originating from unexpected sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rulesets designed to detect and block SQL injection payloads targeting the id parameter.

Public Exploit Available: Yes — a published proof-of-concept exists in the researcher's technical write-up on GitHub.

The severity of this vulnerability, combined with the availability of public proof-of-concept code, necessitates immediate defensive action. Organizations utilizing this software should implement strict network-level access controls or WAF filtering to prevent exploitation until the vendor releases an official security update.