A critical SQL injection vulnerability in code-projects Mobile Shop 1.0 allows unauthenticated remote attackers to compromise database integrity.

The application fails to properly sanitize the email argument within the /LoginAsAdmin.php script, which facilitates SQL injection. As the attack vector is network-based with no authentication required, an attacker can remotely execute arbitrary database commands.

The vulnerability poses a high risk to business operations, as successful exploitation enables unauthorized access to backend database contents. With a CVSS score of 7.3, this flaw could lead to data exfiltration, modification of administrative records, or complete compromise of the application data layer, resulting in significant reputational and operational damage.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /LoginAsAdmin.php file or disable the affected application component until a vendor-supplied fix is released.

Proactive Monitoring: Review web server access logs for suspicious patterns, specifically looking for SQL syntax characters such as single quotes or comment markers in POST or GET requests targeting the LoginAsAdmin.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block common SQL injection payloads and inspect traffic directed at the administrative login portal to neutralize attempts before they reach the application.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

Given the availability of a public proof-of-concept and the lack of a vendor patch, this vulnerability presents an immediate risk to any environment hosting the Mobile Shop application. Organizations should prioritize isolating this software from public-facing networks until the vendor provides a secure version, as the ease of exploitation makes it a likely target for automated scanning and manual attacks.