An unauthenticated SQL injection vulnerability in code-projects E-Commerce Website 1.0 poses a critical risk of full database compromise and unauthorized data access.

The application fails to properly sanitize the search parameter within the admin_index_search.php file, which is processed directly in SQL queries. This allows an unauthenticated attacker to inject arbitrary SQL commands to manipulate database operations.

Successful exploitation of this vulnerability grants an attacker the ability to bypass authentication, exfiltrate sensitive customer or administrative data, and potentially modify or delete database contents. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant data breaches and total loss of confidentiality regarding the application database.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /pages/admin_index_search.php endpoint at the web server level to prevent external reach.

Proactive Monitoring: Review web server access logs for anomalous POST requests to admin_index_search.php, particularly those containing SQL syntax characters such as single quotes, dashes, or SQL keywords like SELECT, UNION, and SLEEP.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the search parameter.

Public Exploit Available: Yes, a published proof-of-concept exists in the researcher's GitHub repository.

Due to the lack of an official vendor patch and the availability of a functional proof-of-concept, this vulnerability must be treated with high priority. Organizations currently running E-Commerce Website 1.0 should immediately restrict network access to the vulnerable script or consider migrating to a more secure, supported e-commerce platform to mitigate the risk of unauthorized database manipulation.