A remote SQL injection vulnerability in code-projects Currency Exchange System 1.0 exposes the application to unauthorized database manipulation by unauthenticated attackers.

This vulnerability is a SQL injection (CWE-89) flaw located within the editotheraccount.php script. An unauthenticated attacker can execute arbitrary SQL commands by manipulating the ID parameter.

The exploitation of this flaw could lead to the unauthorized retrieval or modification of sensitive data stored within the exchange system database. Given the CVSS score of 7.3, this represents a high risk to data confidentiality and integrity, potentially leading to a complete compromise of the application data layer and associated service disruption.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected script or disable the functionality entirely until the vendor provides a secure update.

Proactive Monitoring: Monitor database query logs for unusual syntax patterns or unexpected error messages originating from the editotheraccount.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the ID parameter.

Public Exploit Available: Yes, a public proof-of-concept exists via the technical write-up referenced at https://github.com/rassec2/dbcve/issues/15.

Due to the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability poses a significant risk. Organizations currently running version 1.0 of the Currency Exchange System should isolate the application from the public internet or implement strict access controls to prevent exploitation while awaiting a formal security update from the vendor.