A critical SQL injection vulnerability in the code-projects Currency Exchange System 1.0 allows for unauthenticated remote attackers to manipulate backend database queries.

This vulnerability is a SQL injection flaw located within the edit.php file. It allows an unauthenticated remote attacker to inject malicious SQL commands by manipulating the ID argument.

The ability for an unauthenticated attacker to perform SQL injection poses a significant risk to the integrity and confidentiality of the application data. Successful exploitation could lead to unauthorized data access, modification, or potential administrative bypass, justifying the high severity score of 7.3.

Immediate Action: As no official patch is currently available, administrators should restrict access to the edit.php file or take the application offline until the vendor provides a secure update.

Proactive Monitoring: Review web server access logs for anomalous GET or POST requests directed at edit.php containing SQL syntax patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection payloads targeting the ID parameter.

Public Exploit Available: Yes, a published proof-of-concept exists via the GitHub issue referenced in the vulnerability report.

Given the availability of a public proof-of-concept and the nature of SQL injection, this vulnerability presents a clear and present danger to affected environments. Organizations currently running version 1.0 of the Currency Exchange System must prioritize immediate containment and restrict network access to the vulnerable endpoint until a formal vendor patch is released.