A critical SQL injection vulnerability in code-projects Jonnys Liquor 1.0 exposes the application to remote data manipulation and unauthorized database queries.

This flaw is a SQL injection vulnerability (CWE-89) triggered via the Product GET parameter in the detail.php file. The vulnerability is exploitable by an unauthenticated remote attacker.

The exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive database contents, data corruption, or complete loss of database integrity. With a CVSS score of 7.3, this represents a high risk to business operations and data confidentiality, as attackers can manipulate backend queries to extract or alter information without valid credentials.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected web directory or disable the vulnerable detail.php functionality if it is not business-critical.

Proactive Monitoring: Monitor server access logs for anomalous GET requests containing SQL syntax or unusual parameter strings targeting the detail.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the Product parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the GitHub issue referenced in the vulnerability disclosure.

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability poses a significant risk to any environment hosting Jonnys Liquor 1.0. Organizations should apply immediate compensating controls, such as WAF filtering, and isolate the application until a vendor-supplied security patch is released and verified.