An unauthenticated remote SQL injection vulnerability in code-projects E-Commerce Website 1.0 poses a significant risk of unauthorized database manipulation.

The application is susceptible to SQL injection via the supp_id argument in the /pages/supplier_update.php script. This flaw allows an unauthenticated remote attacker to manipulate database queries by injecting arbitrary SQL commands.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access, modification, or deletion of sensitive information stored within the application database. Given the CVSS score of 7.3, this represents a high-severity risk that could compromise the integrity and confidentiality of business data, potentially leading to reputational damage or regulatory non-compliance.

Immediate Action: As no official patch is currently available, administrators should restrict access to the vulnerable /pages/supplier_update.php file or disable the affected functionality until a vendor update is released.

Proactive Monitoring: Security teams should monitor web access logs for suspicious patterns, specifically looking for SQL keywords or anomalous input strings directed toward the /pages/supplier_update.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns and filter malicious input directed at the identified vulnerable parameter.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the researcher's disclosure on GitHub.

This vulnerability presents a clear and present danger due to the availability of proof-of-concept code and the lack of authentication requirements for attackers. Organizations utilizing code-projects E-Commerce Website 1.0 must prioritize implementing compensating controls or disabling the vulnerable component immediately to prevent potential data breaches.