An unauthenticated SQL injection vulnerability in code-projects LifeStyle Store 1.0 allows remote attackers to compromise database integrity and potentially access sensitive data.

The application is susceptible to SQL injection via the ID parameter in the cart_add.php script. This flaw permits an unauthenticated remote attacker to inject arbitrary SQL commands into the database backend.

Successful exploitation of this vulnerability could lead to unauthorized access to application data, potential modification of database contents, or complete compromise of the underlying database server. Given the CVSS score of 7.3, this represents a high-risk security flaw that requires immediate attention to prevent data breaches and maintain the confidentiality and integrity of the system.

Immediate Action: Since no official patch is available, administrators should restrict access to the affected cart_add.php endpoint or disable the vulnerable functionality until a vendor update is released.

Proactive Monitoring: Review web server access logs for anomalous URL patterns targeting cart_add.php, particularly those containing SQL syntax characters like single quotes, dashes, or SQL keywords.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection protection rules to filter malicious input directed at the vulnerable parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked GitHub issue.

This vulnerability presents a significant risk due to the ease of exploitation and the potential for direct database interaction. Organizations currently running code-projects LifeStyle Store 1.0 must prioritize implementing compensating controls or removing the affected component immediately to mitigate the threat of unauthorized data access.