An unauthenticated SQL injection vulnerability in Code-Projects Simple Stock System 1.0 exposes the underlying database to unauthorized access and potential remote compromise.

The application fails to properly sanitize user input in the username parameter within the login.php file. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands, leading to unauthorized database interactions.

Successful exploitation of this vulnerability permits unauthorized access to sensitive database contents, data tampering, and potential full system compromise. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, which could lead to severe operational disruption and loss of sensitive information.

Immediate Action: As no official patch is currently available, administrators should restrict access to the application via network-level controls or disable the service until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous POST requests to login.php containing SQL-specific characters or suspicious query patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the login endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability research.

Due to the lack of an available vendor patch, the risk associated with this vulnerability is high. Organizations currently running Simple Stock System 1.0 must treat this as a priority issue, implement the recommended compensating controls immediately, and prepare to migrate or upgrade once the vendor provides a secure version.