An unauthenticated SQL injection vulnerability in the code-projects Online Ordering System 1.0 poses a significant risk of unauthorized database interaction and information disclosure.

This is a SQL injection flaw (CWE-89) triggered by improper sanitization of the Name argument within the user_contact.php script. The vulnerability is remotely exploitable without requiring authentication from the attacker.

The ability for an unauthenticated user to inject arbitrary SQL commands into the application database can lead to unauthorized data access, potential modification of sensitive records, or total loss of data integrity. With a CVSS score of 7.3, this high-severity flaw represents a significant threat to the confidentiality and availability of the organization's information assets.

Immediate Action: As no official vendor patch is currently confirmed, administrators should restrict public access to the user_contact.php endpoint or disable the affected module entirely until a fix is released.

Proactive Monitoring: Security teams should monitor web server logs for suspicious URL patterns containing SQL syntax, such as UNION, SELECT, or comment characters, directed at the user_contact.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads to mitigate the risk of exploitation while the underlying code remains vulnerable.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability report.

Given the availability of a public proof-of-concept and the high severity of SQL injection, this vulnerability requires immediate attention. Organizations should prioritize restricting access to the affected script and monitoring for any signs of unauthorized database interaction until a formal security update is provided by the vendor.