An unauthenticated SQL injection vulnerability in Fruits Bazar Ecommerce project 1.0 allows for complete database compromise and unauthorized data access.

The application is susceptible to SQL injection via the show_price_by_pdtId.php endpoint, which fails to properly sanitize user input. This flaw is exploitable by an unauthenticated remote attacker.

The vulnerability carries a CVSS score of 9.8, indicating a critical risk to the confidentiality, integrity, and availability of the application. An attacker can execute arbitrary SQL commands to extract sensitive customer information, modify database records, or potentially gain administrative access to the underlying server environment.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected script or disable the vulnerable component until a fix is provided by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected character strings targeting the show_price_by_pdtId.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads directed at the application.

Public Exploit Available: No (the available data does not confirm a published, weaponized exploit).

Given the critical severity and the lack of a vendor-supplied patch, immediate containment is required. Security teams should prioritize isolating the affected application from public-facing networks or implementing strict WAF filtering to prevent unauthorized database queries. Vigilant monitoring for signs of data exfiltration is essential until the vendor releases a secure version.