A critical SQL injection vulnerability in SourceCodester Pet Grooming Management Software 1.0 permits unauthenticated remote attackers to compromise the underlying database.

The application fails to properly sanitize user input provided to the ID parameter in the print1.php file. This allows an unauthenticated attacker to inject malicious SQL queries, leading to unauthorized database access, data leakage, or system manipulation.

Successful exploitation of this flaw allows attackers to bypass authentication and interact directly with the backend database. This can result in the complete compromise of sensitive business data, unauthorized modification of records, or potential service disruption. Given the CVSS score of 7.3, this represents a significant risk to data integrity and confidentiality for organizations utilizing this software.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory and disable the vulnerable print1.php script if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected characters in the ID parameter, particularly those originating from untrusted sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, such as UNION SELECT or time-based sleep commands, directed at the /admin/print1.php endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub research write-up referenced in the CVE record.

The presence of a functional proof-of-concept for an unauthenticated SQL injection vulnerability creates a high risk for any organization running version 1.0 of this software. Administrators must treat this as a high-priority issue. Until a vendor-supplied patch is released, implement strict network segmentation and WAF filtering to prevent exploitation attempts against this critical flaw.