An unauthenticated remote SQL injection vulnerability in code-projects Computer Book Store 1.0 poses a significant risk of unauthorized database interaction.

This vulnerability is a SQL injection flaw (CWE-89) triggered via the bookisbn parameter in the /admin_delete.php file. The vulnerability is remotely exploitable without requiring authentication (PR:N).

Successful exploitation allows an attacker to execute arbitrary SQL commands against the backend database. This could lead to unauthorized data exposure, modification of records, or potential bypass of application logic. Given the CVSS score of 7.3, this represents a high-severity risk to the integrity and confidentiality of the store application.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected /admin_delete.php endpoint or disable the vulnerable component entirely.

Proactive Monitoring: Review web server and database logs for suspicious SQL syntax or patterns indicating injection attempts, such as UNION SELECT statements or unexpected character encoding.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the bookisbn parameter.

Public Exploit Available: Yes, a published proof-of-concept exists via the GitHub issue referenced in the vulnerability report.

Due to the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability requires immediate attention. Organizations should prioritize isolating the affected application from public-facing networks until a vendor-supplied security update is released and applied.