A critical SQL injection vulnerability in the itsourcecode Online Pet Shop Management System 1.0 allows for unauthenticated remote exploitation, posing a significant risk of unauthorized database interaction.

The software is susceptible to SQL injection via the cnpname parameter in the /pet1/addcnp.php file. This vulnerability is accessible to unauthenticated remote attackers who can manipulate the input to execute arbitrary SQL commands.

The ability for an unauthenticated attacker to execute arbitrary SQL queries represents a severe risk to data integrity and confidentiality. Successful exploitation could lead to unauthorized access to sensitive pet shop data, database manipulation, or potential exfiltration of user information. With a CVSS score of 7.3, this vulnerability requires immediate attention to prevent unauthorized system compromise.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /pet1/addcnp.php endpoint or disable the affected functionality entirely.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting /pet1/addcnp.php, specifically looking for characters indicative of SQL injection attempts such as single quotes, semicolons, or SQL keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule designed to detect and block SQL injection patterns specifically targeting the cnpname parameter.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the research write-up at https://github.com/sec-dreamer/vulpxnPolm/issues/1.

Given the availability of a public proof-of-concept and the ease of exploitation via remote network access, organizations utilizing this software must prioritize mitigation immediately. Since a formal vendor patch is not confirmed, strict input validation or the removal of the vulnerable component is necessary to secure the environment against potential attackers.