The indieka900 online-shopping-system-php is vulnerable to unauthenticated SQL injection, enabling potential data theft or database manipulation.

This is an SQL injection vulnerability located in the master/review_action.php file, specifically within the proId parameter. The vulnerability is exploitable by unauthenticated remote attackers.

Exploitation of this vulnerability allows unauthorized access to the application's backend database. Attackers could extract sensitive customer information, bypass authentication mechanisms, or modify application data, leading to a significant breach of confidentiality and integrity. The 9.8 CVSS score underscores the severity of this unauthenticated access risk.

Immediate Action: No official patch is currently available; users should restrict public access to the affected directory or migrate to a secure alternative.

Proactive Monitoring: Monitor database query logs for unusual patterns or syntax errors that suggest SQL injection attempts targeting the proId parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection filtering rules to inspect and block malicious input targeting the master/review_action.php endpoint.

Public Exploit Available: Yes — a public proof-of-concept exists in the referenced GitHub repository.

Given the existence of a public proof-of-concept, this vulnerability poses an elevated risk. Since no official patch is currently available, organizations should implement stringent WAF controls and consider restricting public access to the vulnerable system until a secure version is released.