A critical SQL injection vulnerability in SourceCodester Pet Grooming Management Software 1.0 exposes the underlying database to unauthorized manipulation by unauthenticated remote attackers.

The application fails to properly sanitize the id parameter within the /admin/edit_tax.php file, which allows an unauthenticated attacker to perform SQL injection attacks. This vulnerability enables direct interaction with the database layer.

Successful exploitation of this vulnerability can lead to unauthorized access, modification, or deletion of sensitive business data stored within the application database. With a CVSS score of 7.3, this flaw represents a high risk to data confidentiality and integrity, potentially resulting in significant operational disruption or the compromise of customer information.

Immediate Action: As no vendor patch is currently available, administrators should immediately restrict access to the /admin/ directory using network-level controls or web server authentication to prevent unauthorized requests to the vulnerable script.

Proactive Monitoring: Security teams should audit web server access logs for anomalous requests containing SQL syntax or unusual characters directed at the edit_tax.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, such as UNION SELECT or tautology-based payloads, targeting the id parameter.

Public Exploit Available: Yes, a public proof-of-concept exists via the GitHub repository referenced in the vulnerability disclosure.

Given the availability of public proof-of-concept material and the unauthenticated nature of this flaw, organizations utilizing this software must treat this as a high-priority risk. Until an official update is provided by the vendor, implementing strict access controls to the administrative interface and utilizing WAF protections is essential to preventing potential data compromise.