An unauthenticated SQL injection vulnerability in g33kyrash Online-Banking-System poses a critical risk of unauthorized database manipulation and information disclosure.

This is a SQL injection (CWE-89) vulnerability occurring in the /index.php file. The application fails to properly sanitize the Username argument, allowing an unauthenticated remote attacker to inject malicious SQL commands.

Successful exploitation allows an attacker to interact directly with the backend database, potentially leading to the unauthorized exfiltration of sensitive banking data, credential theft, or modification of transaction records. Given the CVSS score of 7.3, this represents a significant risk to data integrity and confidentiality that could result in severe regulatory penalties and loss of customer trust.

Immediate Action: Since a formal patch is currently unavailable due to the rolling release nature of the software, administrators must restrict access to the affected index.php endpoint or disable the vulnerable functionality until the vendor provides a remediation.

Proactive Monitoring: Review web server and database logs for anomalous input patterns in the Username field, such as SQL keywords or special characters commonly used in injection attacks.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeted at the application entry points.

Public Exploit Available: Yes, a public proof-of-concept exists and is documented in the researcher write-up at the provided GitHub repository.

The presence of a public proof-of-concept significantly elevates the urgency of this finding. Organizations utilizing this software must prioritize the implementation of compensating controls, such as WAF filtering, to mitigate the risk of SQL injection while awaiting a permanent software update from the developer.