An unauthenticated SQL injection vulnerability in code-projects AVL Rooms 1.0 poses a significant risk of unauthorized database interaction and potential data compromise.

This is a SQL injection vulnerability located in the profile.php file, triggered by the manipulation of the first_name parameter. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands against the backend database.

The ability for an unauthenticated attacker to perform SQL injection can lead to the unauthorized disclosure, modification, or destruction of sensitive data stored within the application database. With a CVSS score of 7.3, this vulnerability is classified as High, reflecting the potential for significant impact on data integrity and confidentiality.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected profile.php endpoint at the network or application firewall level.

Proactive Monitoring: Review web server access logs for suspicious input patterns, particularly requests containing SQL syntax or unusual characters within the first_name parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue linked by the CVE record.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a credible risk to the integrity of the affected system. Administrators should treat this as a priority, implementing WAF protections and restricting external access to the vulnerable component until an official security update is provided by the vendor.