An unauthenticated SQL injection vulnerability in code-projects E-Commerce Website allows remote attackers to execute arbitrary database queries, posing a significant risk to data integrity.

The application fails to properly sanitize the prod_id parameter within the /pages/admin_product_details.php script, resulting in a SQL injection vulnerability. An unauthenticated attacker can exploit this flaw remotely to interact with the underlying database.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information stored within the database, including customer data or administrative credentials. Given the CVSS score of 7.3, this flaw is categorized as High severity, as it facilitates unauthorized data modification or exfiltration that could result in significant reputational damage and regulatory non-compliance.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected endpoint /pages/admin_product_details.php or take the application offline until a secure version is released.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically looking for SQL syntax characters or unexpected administrative access attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules specifically configured to detect and block common SQL injection payloads targeting the prod_id parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository.

Due to the lack of an official vendor patch and the availability of a public proof-of-concept, this vulnerability presents an elevated risk. Organizations currently utilizing code-projects E-Commerce Website 1.0 must prioritize isolating the affected component and applying strict network-level access controls to prevent unauthorized exploitation.