A critical SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 allows unauthenticated remote attackers to compromise the application database.

The application is susceptible to SQL injection via the delid parameter in the /admin/readenq.php file. This vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N.

The ability for an unauthenticated attacker to perform SQL injection poses a severe risk to data confidentiality, integrity, and availability. Successful exploitation could lead to unauthorized access to sensitive administrative data or complete database compromise. With a CVSS score of 7.3, this flaw represents a significant security risk, especially given the ease of remote execution.

Immediate Action: As there is no official patch available, administrators should restrict access to the /admin/ directory using network-level controls or web server authentication until a vendor fix is released.

Proactive Monitoring: Security teams should audit web server access logs for suspicious input patterns, specifically looking for SQL syntax or unusual characters within the delid parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the identified vulnerable endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Given that this vulnerability is remotely exploitable without authentication and a public proof-of-concept is available, organizations should prioritize isolating the affected system. It is imperative to monitor for signs of unauthorized database interaction and implement strict access controls until the vendor provides an official security patch.