The code-projects E-Commerce Website 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise the backend database.

The application fails to properly sanitize the user_id parameter within the admin_account_update.php script, which is processed directly in SQL queries. This flaw allows an unauthenticated attacker to execute arbitrary SQL commands against the database.

A successful exploit of this vulnerability grants an attacker unauthorized access to the underlying database, which may contain sensitive customer information, administrative credentials, and transaction records. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to complete data exfiltration, unauthorized modification of records, or total system compromise, resulting in significant reputational and operational damage.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the admin_account_update.php endpoint or disable the affected functionality entirely until a secure update is provided.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as UNION statements, time-based sleep commands, or unexpected error-based injection attempts originating from the application.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection protection rules to filter and block malicious payloads targeting the user_id parameter.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in a published security research report.

Due to the lack of a formal vendor patch and the availability of public proof-of-concept material, this vulnerability poses an immediate risk to any deployment of E-Commerce Website 1.0. Organizations are strongly advised to implement the aforementioned compensating controls immediately and prioritize the migration to a more secure platform or the manual application of prepared statements to the vulnerable source code.