A critical SQL injection vulnerability exists in code-projects Wedding Reservation 1.0 that allows unauthenticated remote attackers to compromise database integrity.

This vulnerability is a SQL injection flaw (CWE-89) affecting the global.php file. An unauthenticated attacker can trigger the flaw by manipulating the lu parameter to execute unauthorized database commands.

The ability for an unauthenticated remote attacker to perform SQL injection poses a significant risk to data confidentiality and integrity. With a CVSS score of 7.3, this high-severity flaw could lead to unauthorized data exfiltration, modification of application records, or potential administrative account takeover, resulting in severe operational disruption and loss of trust.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the application or take the service offline until the vendor releases a security update.

Proactive Monitoring: Review web server access logs for suspicious requests containing SQL syntax or unusual characters directed at the global.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the lu parameter.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the linked GitHub issue.

Given the public availability of exploit code, this vulnerability presents an immediate risk to any deployment of Wedding Reservation 1.0. Organizations should prioritize isolating affected systems and implementing strict WAF filtering while awaiting a formal vendor patch. Failure to mitigate this flaw exposes the underlying database to unauthorized manipulation by any remote actor.