A critical SQL injection vulnerability in Projectworlds Online Shopping System 1.0 exposes the application to remote, unauthenticated database manipulation.

The vulnerability is a SQL injection (CWE-89) located within the login_submit.php file. An unauthenticated attacker can exploit this by injecting malicious SQL commands into the keywords parameter, allowing for unauthorized interaction with the underlying database.

The ability to perform SQL injection poses a significant risk to the confidentiality and integrity of the application, as it potentially allows attackers to bypass authentication, extract sensitive user data, or modify database contents. With a CVSS score of 7.3, this high-severity flaw could lead to full compromise of the application data, resulting in severe reputational damage and potential regulatory non-compliance regarding data protection.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the affected login_submit.php endpoint or disable the vulnerable module until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous traffic patterns, specifically looking for SQL syntax characters such as single quotes, semicolons, and comment indicators within the keywords parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the login_submit.php script.

Public Exploit Available: Yes, a published proof-of-concept exists as referenced in the GitHub issue linked by the CVE record.

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability presents an immediate risk to any deployment of Projectworlds Online Shopping System 1.0. Organizations should prioritize isolating the affected system from the public internet and applying strict input validation or security patches as soon as the vendor provides them.