Projectworlds Online Shopping System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to manipulate database queries and potentially compromise system data.

This vulnerability is a SQL injection (CWE-89) flaw located in the store/cart_add.php file. The lack of proper input validation on the ID argument allows an unauthenticated remote attacker to execute arbitrary SQL commands.

The ability to perform SQL injection poses a significant risk to the confidentiality and integrity of the application database. With a CVSS score of 7.3, this high-severity flaw could allow attackers to exfiltrate sensitive customer data, modify order information, or gain unauthorized access to the underlying database management system, leading to severe reputational damage and potential regulatory non-compliance.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the vulnerable store/cart_add.php file or disable the affected shopping module until a security update is released by the vendor.

Proactive Monitoring: Security teams should monitor web access logs for suspicious patterns, specifically looking for URL parameters containing SQL syntax or unusual GET/POST requests directed at the /store/cart_add.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced security report.

Given the high CVSS score and the existence of a public proof-of-concept, this vulnerability represents a significant risk to the application environment. Organizations currently utilizing Projectworlds Online Shopping System 1.0 should prioritize the implementation of compensating controls such as WAF rules immediately, as no official vendor patch is currently available to remediate the underlying flaw.