An unauthenticated SQL injection vulnerability in the JackieDYH Resume-management-system allows remote attackers to execute arbitrary database commands, posing a significant risk to data integrity.

The application is susceptible to SQL injection (CWE-89) within the /admin/show.php file, specifically through the userid parameter. This vulnerability can be exploited by an unauthenticated remote attacker to perform unauthorized database operations.

Successful exploitation of this vulnerability allows for unauthorized access to or modification of sensitive data stored within the application database. Given the CVSS score of 7.3, this flaw is categorized as High severity, as it provides a direct path for attackers to compromise the confidentiality and integrity of the system without requiring prior authentication.

Immediate Action: As no official patch is currently available from the vendor, restrict access to the /admin/show.php endpoint or the entire administrative interface at the network level using a firewall or access control list.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected SQL syntax or attempts to extract large volumes of data, which may indicate active exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection payloads targeting the userid parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the CVE record.

Due to the lack of a vendor-supplied patch and the confirmed existence of a public proof-of-concept, this vulnerability must be treated with high urgency. Administrators should immediately implement network-level restrictions to prevent unauthorized access to the vulnerable endpoint and utilize WAF protections until a formal security update is released.