The Mobile Shop 1.0 application is vulnerable to remote SQL injection, which may allow an unauthenticated attacker to compromise backend database integrity.

This vulnerability is a SQL injection flaw (CWE-89) located in the login.php file. The application fails to properly sanitize the email parameter, allowing an unauthenticated remote attacker to execute arbitrary SQL commands.

The ability for an unauthenticated user to inject arbitrary SQL queries poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to user accounts, exposure of sensitive customer information, or potential disruption of service. With a CVSS score of 7.3, this vulnerability represents a high-risk entry point that could be leveraged to facilitate broader system compromise.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected login.php endpoint or disable the application until the vendor releases a security update.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests to login.php containing SQL syntax characters, such as single quotes, double dashes, or union keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns targeting the login interface.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations currently running code-projects Mobile Shop 1.0 must prioritize the implementation of WAF protections and restrict network access to the application until a permanent vendor-supplied patch is identified and applied.