An unauthenticated SQL injection vulnerability in code-projects Electricity Billing System version 1.0 poses a significant risk of unauthorized database interaction and potential credential compromise.

The application is vulnerable to SQL injection due to improper neutralization of special elements used in an SQL command within the /user/change_password.php file. An unauthenticated attacker can supply malicious input via the new_password argument to execute arbitrary database queries.

The ability for an unauthenticated user to perform SQL injection attacks presents a severe threat to the confidentiality and integrity of the application database. Successful exploitation could lead to unauthorized access to user account information, potential credential theft, or further compromise of the underlying server environment. With a CVSS score of 7.3, this vulnerability represents a high-severity risk that requires immediate attention to prevent data exfiltration.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /user/change_password.php endpoint or disable the affected functionality until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for anomalous requests directed at the change_password.php file, particularly those containing SQL syntax characters such as single quotes or comment markers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting password change parameters.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the technical write-up provided in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the unauthenticated nature of the attack vector, this vulnerability should be treated as a high priority. Organizations using the Electricity Billing System 1.0 must prioritize the implementation of compensating controls, such as WAF rules, and monitor for vendor communication regarding a permanent patch. Failure to mitigate this access point could allow attackers to gain unauthorized control over the application data.