A critical SQL injection vulnerability in code-projects Simple Shopping Cart 1.0 allows unauthenticated remote attackers to compromise database integrity.

This vulnerability is a SQL injection (CWE-89) located in the register.php file. An unauthenticated attacker can manipulate the ruser_email argument to perform unauthorized database operations.

The ability to perform remote SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could allow an attacker to dump sensitive user information, bypass authentication mechanisms, or modify application data, leading to severe reputational damage and potential loss of customer trust. Given the CVSS score of 7.3, this flaw is considered a high-severity risk that requires immediate attention.

Immediate Action: As no official patch is currently available, administrators should restrict access to the registration functionality or take the application offline until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests to the register.php file, specifically looking for SQL syntax patterns or unexpected characters in the ruser_email field.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block SQL injection payloads targeting the registration endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the referenced security report.

The presence of a public proof-of-concept significantly increases the risk of automated exploitation. Organizations utilizing code-projects Simple Shopping Cart 1.0 must treat this as a priority item. If an immediate update is not available, disabling the vulnerable registration module is the most effective way to eliminate the attack surface until the vendor provides a formal patch.