The LifeStyle Store 1.0 application is susceptible to an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries.

This flaw is a SQL injection (CWE-89) located in the /success.php file. An unauthenticated attacker can exploit this remotely by injecting malicious input into the ID parameter.

The ability for an unauthenticated user to execute arbitrary SQL commands poses a significant threat to data confidentiality and integrity. With a CVSS score of 7.3, this high-severity vulnerability could allow an attacker to bypass authentication, extract sensitive information from the backend database, or potentially disrupt application services.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /success.php endpoint or disable the affected functionality entirely.

Proactive Monitoring: Review web server access logs for unusual patterns or characters in the ID parameter of requests directed at /success.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules to detect and block common SQL injection payloads targeting the identified parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as referenced in the vulnerability report at https://github.com/rom4j/cve/issues/18.

Given the availability of a public proof-of-concept and the ease of exploitation over the network, this vulnerability presents a clear and present risk. Organizations using LifeStyle Store 1.0 must prioritize implementing network-level blocks or WAF rules immediately to prevent unauthorized database access until an official security update is released by the vendor.