A critical SQL injection vulnerability in SourceCodester Simple E-Commerce Bookstore 1.0 allows unauthenticated remote attackers to compromise the backend database.

This vulnerability is a SQL injection flaw (CWE-89) triggered through the register_username argument in the /register.php script. The vulnerability allows an unauthenticated attacker to inject arbitrary SQL commands into the application database.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive customer data, potential modification of database contents, or complete compromise of the underlying application data. Given the CVSS score of 7.3, this represents a significant risk to the integrity and confidentiality of the bookstore application, necessitating immediate attention.

Immediate Action: Since no official vendor patch is currently available, administrators should immediately restrict access to the /register.php endpoint or disable the registration feature until a secure update is released.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests targeting /register.php, specifically looking for SQL syntax patterns or unexpected character sequences in the register_username parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules configured to detect and block SQL injection attempts targeting the registration endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists via the GitHub issue referenced in the vulnerability report.

The presence of a public proof-of-concept for this SQL injection vulnerability significantly elevates the risk of exploitation. Administrators must prioritize isolating the affected application from public network access or implementing robust WAF filtering until the vendor provides a formal patch. Failure to mitigate this entry point leaves the system highly susceptible to database compromise.