A critical SQL injection vulnerability exists in SourceCodester Simple E-Commerce Bookstore 1.0, which allows unauthenticated remote attackers to execute arbitrary database queries.

This vulnerability is a SQL injection (CWE-89) flaw located within the cart.php file. An unauthenticated remote attacker can trigger this issue by sending a crafted request to the remove parameter, leading to unauthorized database interaction.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive bookstore data, potential data modification, or total compromise of the underlying database. With a CVSS score of 7.3, this represents a high-severity risk that could lead to significant data breaches and compromise the integrity of the e-commerce platform.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the affected web application or take the service offline until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous requests to /cart.php, specifically monitoring the remove argument for SQL syntax characters such as single quotes, semicolons, or comment sequences.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the cart.php endpoint.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the linked GitHub issue (https://github.com/DrNbnonono/CVE/issues/2).

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to any organization running the Simple E-Commerce Bookstore. Until a vendor-supplied patch is available, organizations must prioritize implementing compensating controls or restricting public access to the application to prevent potential database compromise.