The Refugee Food Management System version 1.0 contains a critical SQL injection vulnerability that allows unauthenticated attackers to gain unauthorized database access and potentially compromise the entire system.

The application fails to properly sanitize user-supplied input in the 'a' parameter within the addusers.php file. This allows an unauthenticated attacker to inject malicious SQL queries directly into the backend database.

Successful exploitation of this vulnerability permits unauthorized database access, which may lead to sensitive data exfiltration, data tampering, or full system compromise. Given the CVSS score of 7.3, this flaw presents a high risk to business operations, as it enables remote attackers to bypass security controls and potentially disrupt services or steal proprietary information.

Immediate Action: As no official patch is currently available, administrators should restrict access to the addusers.php file via network-level controls or web server configurations until a fix is provided by the vendor.

Proactive Monitoring: Monitor web server access logs for anomalous POST requests to the addusers.php endpoint, particularly those containing SQL syntax or characters commonly used in injection attacks.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the 'a' parameter.

Public Exploit Available: Yes, a published proof-of-concept is available via the researcher's GitHub issue report.

The presence of a public proof-of-concept significantly elevates the risk of exploitation for this high-severity flaw. Security teams must prioritize isolating the affected application from public-facing networks. Until the vendor releases a security update, strict input validation and the implementation of prepared statements remain the only effective methods to neutralize this threat.