A critical SQL injection vulnerability in code-projects Currency Exchange System 1.0 exposes the application to remote, unauthenticated database manipulation.

This is a SQL injection vulnerability (CWE-89) located in the viewserial.php file, where insufficient validation of the ID parameter allows an unauthenticated remote attacker to execute arbitrary SQL commands.

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk that could lead to unauthorized data access, modification, or potential loss of database integrity. Successful exploitation could allow attackers to bypass security controls and access sensitive information within the exchange system, posing a significant risk to operational data confidentiality and system availability.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the application or disable the vulnerable component until a fix is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns targeting the viewserial.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the ID parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the GitHub issue referenced by the vulnerability record.

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability presents an immediate risk. Organizations utilizing this software must implement strict network-level access controls and monitoring to prevent exploitation until an official update is deployed.