An unauthenticated SQL injection vulnerability in code-projects E-Commerce Website 1.0 poses a critical risk of full database compromise and unauthorized data manipulation.

This is a time-based blind SQL injection flaw located in the user_id parameter of the admin_account_delete.php file. The application fails to sanitize user-supplied input, allowing an unauthenticated attacker to inject malicious SQL commands directly into the backend database.

Successful exploitation of this vulnerability allows an attacker to bypass authentication, extract sensitive customer or administrative data, modify application records, or potentially gain administrative control over the underlying database. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant data breaches, loss of customer trust, and severe disruption to business operations.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /pages/admin_account_delete.php file or take the application offline until the code can be manually hardened.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL keywords or time-based delay patterns, particularly targeting the admin_account_delete.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the user_id parameter.

Public Exploit Available: Yes — a published proof-of-concept and technical write-up are available on GitHub via the researcher K1nako.

The presence of a public proof-of-concept significantly lowers the barrier for exploitation by malicious actors. Organizations currently running version 1.0 of the code-projects E-Commerce Website must treat this as a high-priority incident. Until a vendor-supplied update is released, implement strict network-level access controls or WAF filtering to prevent unauthorized interaction with the vulnerable script.