An unauthenticated SQL injection vulnerability in the Refugee Food Management System (version 1.0) poses a critical risk of data theft and total system compromise.

The application is vulnerable to SQL injection (CWE-89) because it fails to properly sanitize user-supplied input in the rfid parameter within the pagenateRefugeesList.php file. This flaw allows an unauthenticated attacker to manipulate database queries directly.

Successful exploitation grants an attacker the ability to bypass authentication, exfiltrate sensitive data, modify database contents, or potentially gain full control of the underlying server. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant data breaches, loss of customer trust, and operational disruption.

Immediate Action: As no official patch is currently available, administrators should restrict access to the application via network-level controls or disable the vulnerable component if it is not business-critical. Developers must transition to using prepared statements with parameter binding to safely handle user input.

Proactive Monitoring: Review web server and database logs for anomalous GET requests targeting the pagenateRefugeesList.php file, specifically looking for characters indicative of SQL injection such as single quotes, semicolons, or SQL keywords like UNION and SELECT.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection protection rules to block malicious payloads targeting the rfid parameter. Ensure that the database service account is configured with the principle of least privilege to limit the scope of potential unauthorized actions.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents an urgent risk. Organizations currently utilizing version 1.0 of the Refugee Food Management System must treat the system as compromised if it is internet-facing and apply the recommended input sanitization measures immediately to prevent unauthorized database access.