A remote SQL injection vulnerability in code-projects Simple Shopping Cart 1.0 poses a significant risk to database integrity and administrative access.

The application is susceptible to SQL injection (CWE-89) because it fails to properly sanitize the admin_username argument within the adminlogin.php file. This allows an unauthenticated remote attacker to inject malicious SQL queries into the backend database.

The vulnerability allows unauthorized interaction with the application database, which can lead to data exfiltration or unauthorized authentication bypass. Given the CVSS score of 7.3, this flaw is categorized as high severity, as it facilitates direct control over database operations without requiring prior authentication.

Immediate Action: As no official patch is currently available, administrators should restrict access to the adminlogin.php file or disable the affected component entirely until a security update is released by the vendor.

Proactive Monitoring: Monitor web server access logs for suspicious input patterns in the admin_username field, specifically looking for SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the login endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the provided GitHub issue reference.

Due to the lack of an official vendor patch and the availability of a public proof-of-concept, this vulnerability presents an immediate risk to any deployment of Simple Shopping Cart 1.0. Organizations should prioritize isolating the affected application from public-facing networks until a remediated version is available.