An unauthenticated SQL injection vulnerability in the Simple Cafe Ordering System allows attackers to bypass authentication and execute arbitrary database queries.

The application fails to sanitize user-supplied input before incorporating it into SQL queries, using insecure legacy database functions. This flaw permits an unauthenticated remote attacker to manipulate database queries via the Username parameter to perform authentication bypass or data extraction.

A successful exploit allows an unauthorized actor to bypass authentication, potentially gaining full administrative access to the system. This can lead to total data compromise, including user credentials and transaction records, as well as the ability to manipulate business logic such as order placement. Given the CVSS score of 7.3, this represents a significant risk to the integrity and confidentiality of the application data.

Immediate Action: As no official vendor patch is available, developers must manually replace all instances of the deprecated mysql_* functions with PDO or mysqli using parameterized queries and prepared statements.

Proactive Monitoring: Security teams should monitor web server and database logs for anomalous query patterns, such as the use of SQL comment syntax or boolean logic characters in input fields, which may indicate active exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block common SQL injection payloads, such as tautologies or union-based queries, to provide virtual patching until the source code can be remediated.

Public Exploit Available: Yes — a published proof-of-concept exists in the researcher's technical write-up linked in the CVE references.

The presence of a publicly available proof-of-concept combined with the ease of exploitation makes this a high-priority issue for any organization utilizing the Simple Cafe Ordering System. Because the software appears to lack an official update path, organizations should prioritize migrating to a more secure alternative or performing an immediate code-level audit to implement prepared statements, as the current state of the software is unsuitable for production environments.