A critical SQL injection vulnerability in the code-projects Online Ordering System allows unauthenticated remote attackers to compromise the application database.

The application suffers from a SQL injection flaw (CWE-89) within the admin login interface, specifically triggered via the Username parameter. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N).

The ability to perform remote SQL injection allows an attacker to interact directly with the underlying database, potentially leading to unauthorized data access, modification, or full administrative account compromise. Given the CVSS score of 7.3, this flaw poses a significant risk to the confidentiality and integrity of the ordering system, which could result in severe operational disruption or sensitive customer data exposure.

Immediate Action: Since no official vendor patch is currently available, users should restrict access to the /admin/ directory using network-level controls or IP allowlisting to prevent external reachability.

Proactive Monitoring: Security teams should audit web server access logs for anomalous SQL syntax or unexpected query patterns directed at the login endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block common SQL injection payloads targeting authentication parameters.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the technical write-up referenced at https://github.com/zzb1388/cve/issues/95.

The presence of a publicly disclosed proof-of-concept significantly elevates the urgency of this vulnerability. Organizations using this software must immediately implement restrictive access controls for the administrative interface while awaiting a formal security update from the vendor.