An unauthenticated SQL injection vulnerability in SourceCodester Pet Grooming Management Software 1.0 allows remote attackers to compromise database integrity and potentially gain full system control.

This vulnerability is a SQL injection flaw located in the fetch_product_details.php file. An unauthenticated attacker can supply malicious input to the barcode parameter, which is then processed by the backend database without proper sanitization or parameterization.

Successful exploitation allows an attacker to execute arbitrary SQL commands, which can lead to unauthorized access to sensitive business data, data modification, or complete deletion of database contents. Given the CVSS score of 7.3, this represents a significant risk to confidentiality and integrity, potentially resulting in severe operational disruption and loss of customer trust.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the affected application instance or take the service offline until a secure version is released.

Proactive Monitoring: Review web server access logs for suspicious POST requests to fetch_product_details.php, specifically looking for SQL injection payloads such as OR, UNION, or error-based syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns in HTTP request parameters to provide a layer of protection against exploitation attempts.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the linked security researcher write-up.

Due to the lack of an official patch and the presence of public proof-of-concept code, this vulnerability poses a clear and present danger to any organization using this software. Organizations should immediately isolate the affected system from public networks and prioritize the implementation of strict input validation or transition to a more secure management platform.