A critical SQL injection vulnerability in Code-Projects Web-Based Inventory and POS System 1.0 permits unauthenticated remote attackers to compromise backend database integrity.

This vulnerability is a SQL injection flaw (CWE-89) located in the login.php file. The application fails to sanitize the emailid parameter before incorporating it into SQL statements, enabling an unauthenticated attacker to execute arbitrary database commands.

Successful exploitation of this vulnerability allows unauthorized access to sensitive data stored within the backend database. Given the CVSS score of 7.3, this represents a significant risk to confidentiality and integrity, potentially leading to full database compromise or unauthorized administrative access to the POS system.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the login portal and implement strict input validation at the application level.

Proactive Monitoring: Review web server access logs for anomalous POST requests to login.php containing SQL syntax characters or unexpected patterns in the emailid parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection attack vectors targeting the login endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked research writeup on GitHub.

The presence of a functional proof-of-concept makes this vulnerability highly concerning despite the lack of confirmed active exploitation. Organizations utilizing this software should prioritize network-level restrictions and consider moving to a more secure, actively maintained platform, as the current lack of a vendor-provided patch leaves the application exposed to trivial exploitation.