Project Monitoring System 1.0 is vulnerable to unauthenticated SQL injection, which may allow remote attackers to extract sensitive database information.

The application fails to properly sanitize user-supplied input in the username and password parameters within the login.php file. This flaw allows an unauthenticated attacker to inject malicious SQL commands directly into the backend database, potentially leading to unauthorized data disclosure.

A successful exploit of this vulnerability could lead to the complete compromise of the underlying database, resulting in the unauthorized access or exfiltration of sensitive organizational data. Given the CVSS score of 7.3, this represents a significant risk to confidentiality and integrity, potentially leading to regulatory non-compliance and reputational damage.

Immediate Action: Since an official patch is currently unavailable, administrators should restrict access to the login.php endpoint using network-level controls or by disabling the affected module if it is not business-critical.

Proactive Monitoring: Security teams should monitor web access logs for suspicious POST requests to login.php containing SQL syntax characters, such as single quotes or comment markers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the login endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in a security research repository on GitHub.

The presence of a public proof-of-concept for this SQL injection vulnerability creates an urgent need for defensive action. Organizations using Project Monitoring System 1.0 must prioritize the implementation of compensating controls, such as WAF rules, and restrict network access to the vulnerable login interface until the vendor releases a secure version.