A critical SQL injection vulnerability in the code-projects Online Bidding System 1.0 allows unauthenticated remote attackers to compromise the underlying database.

The application fails to properly sanitize user-supplied input in the id parameter within the bidlist.php file. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands, leading to unauthorized database access, data exfiltration, or modification.

Successful exploitation of this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the system. An attacker can gain full access to the database, leading to potential sensitive data leakage, unauthorized modification of bid information, and complete system compromise. Given the CVSS score of 7.3, this vulnerability represents a high-risk entry point that could lead to significant reputational damage and business disruption.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /administrator/ directory and implement strict input validation for the id parameter.

Proactive Monitoring: Review web server access logs for anomalous GET requests targeting bidlist.php, specifically looking for SQL syntax patterns like UNION, SELECT, or SLEEP.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the id parameter.

Public Exploit Available: Yes, a public proof-of-concept and detailed attack vectors are documented in the researcher's report on GitHub.

Due to the lack of a vendor-provided security patch, users of the Online Bidding System 1.0 are strongly advised to implement strict network-level access controls and WAF filtering immediately. Organizations should prioritize migrating away from this software if it is not actively maintained, as the identified SQL injection flaw provides an easy pathway for unauthorized database access.