A remote SQL injection vulnerability in code-projects Online Ordering System 1.0 poses a significant risk of unauthorized database interaction and potential data compromise.

This flaw is a SQL injection vulnerability, specifically categorized under CWE-89, occurring within the user_school.php file. The vulnerability is exploitable by an unauthenticated remote attacker through the manipulation of the product_id argument.

The ability to perform remote SQL injection allows an attacker to interact directly with the application backend, potentially leading to unauthorized data exposure or modification. With a CVSS score of 7.3, this represents a High severity risk that could disrupt business operations or compromise sensitive customer and school data.

Immediate Action: As no official patch is currently available, administrators should restrict access to the vulnerable user_school.php file or disable the affected module until the vendor releases a security update.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests containing SQL syntax patterns or unexpected character sequences targeting the product_id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting this application endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the reference at https://github.com/zzb1388/cve/issues/93.

Given the availability of a public proof-of-concept, the risk of exploitation is elevated. Organizations currently running version 1.0 of the code-projects Online Ordering System must prioritize the implementation of compensating controls, such as WAF rules, to mitigate the risk until an official vendor patch is issued.