An unauthenticated SQL injection vulnerability in SourceCodester Pet Grooming Management Software 1.0 allows remote attackers to compromise the application database.

This vulnerability involves improper neutralization of special elements used in an SQL command (CWE-89) within the group_id argument of the /admin/search_product.php script. The vulnerability is exploitable by unauthenticated remote attackers.

The ability for an unauthenticated attacker to perform SQL injection poses a significant risk to data confidentiality and integrity. With a CVSS score of 7.3, this high-severity flaw could allow unauthorized actors to extract sensitive data, modify database records, or potentially gain further control over the underlying server environment.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/search_product.php endpoint or disable the affected module entirely.

Proactive Monitoring: Security teams should review web server access logs for suspicious patterns, such as unexpected SQL syntax or URL-encoded characters in the group_id parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the identified vulnerable script.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked GitHub repository.

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability presents a clear and present danger to affected installations. Organizations must prioritize restricting access to the vulnerable endpoint immediately to prevent unauthorized database interaction, as the attack vector is fully remote and does not require credentials.