A critical SQL injection vulnerability in code-projects E-Commerce Website 1.0 allows for remote, unauthenticated database manipulation.

This is a SQL injection flaw (CWE-89) located in the /pages/user_index_search.php script. The vulnerability permits an unauthenticated remote attacker to inject malicious SQL commands via the Search parameter.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive data, potential modification of database content, and compromise of the application's integrity. While the CVSS score of 7.3 reflects a high severity rating, the ability for an unauthenticated attacker to remotely execute queries poses a significant risk to the confidentiality and availability of the E-Commerce platform.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected script or implement strict input validation to sanitize the Search parameter.

Proactive Monitoring: Security teams should review web server access logs for anomalous patterns, specifically looking for SQL syntax characters such as single quotes, semicolons, or comments in the Search request parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns targeting the /pages/user_index_search.php endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research write-up referenced in the CVE record.

Given the public availability of exploit material and the lack of a vendor-supplied patch, this vulnerability must be treated with high priority. Organizations utilizing this software should immediately implement input filtering or disable the affected search functionality until a secure update is provided by the vendor.