A critical SQL injection vulnerability in SourceCodester Simple E-Commerce Bookstore 1.0 allows unauthenticated remote attackers to manipulate database queries.

This is a SQL injection vulnerability (CWE-89) occurring within the index.php file. An unauthenticated attacker can inject malicious SQL commands by manipulating the login_username argument.

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a significant risk to the confidentiality and integrity of the application database. With a CVSS score of 7.3, this flaw could lead to unauthorized data exfiltration or potential administrative bypass, resulting in severe reputational damage and loss of user trust.

Immediate Action: As no official patch is currently available, administrators should restrict access to the application or implement strict input validation on the login_username parameter.

Proactive Monitoring: Review web server access logs for anomalous characters, such as single quotes or SQL syntax keywords, within the login_username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting login endpoints.

Public Exploit Available: Yes, a public proof-of-concept exists as referenced in the researcher's GitHub submission (https://github.com/DrNbnonono/CVE/issues/5).

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a credible threat to any deployment of the Simple E-Commerce Bookstore. Organizations should prioritize isolating the affected component and applying security controls to filter malicious input until a vendor-supplied patch is released.