A remote SQL injection vulnerability in code-projects LifeStyle Store 1.0 poses a significant risk as it allows unauthenticated attackers to manipulate database queries.

This is a SQL injection vulnerability (CWE-89) occurring in the /cart_remove.php file. An unauthenticated attacker can exploit this flaw by supplying malicious input to the ID parameter, potentially leading to unauthorized database interactions.

Successful exploitation of this SQL injection vulnerability could allow an attacker to read, modify, or delete sensitive information stored in the application database. While the CVSS score of 7.3 indicates a High severity, the ability for an unauthenticated remote attacker to interact with the backend database represents a severe threat to data confidentiality and integrity.

Immediate Action: As no official patch is currently available, organizations should isolate the affected application from public network access or disable the vulnerable /cart_remove.php functionality until a vendor update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected input in the ID parameter of /cart_remove.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability report.

Given the availability of a public proof-of-concept and the lack of an official patch, this vulnerability presents an elevated risk to the integrity of the application. Administrators are strongly advised to restrict access to the affected system immediately and monitor for any signs of unauthorized database activity.