A critical SQL injection vulnerability in code-projects Church Donation System 1.0 allows unauthenticated remote attackers to compromise the application database.

The application is vulnerable to SQL injection within the login.php file, specifically via the Username parameter. This flaw allows an unauthenticated remote attacker to execute arbitrary SQL commands against the database.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive donor and administrative data, potential modification of records, or complete database compromise. Given the CVSS score of 7.3, this represents a significant risk to the integrity and confidentiality of the organization, as the attack requires no authentication and can be executed remotely.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the login page or take the application offline until a secure version is released by the vendor.

Proactive Monitoring: Monitor server access logs for unusual patterns in login requests, specifically looking for SQL syntax or special characters within the Username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting authentication endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the referenced GitHub issue.

The presence of a publicly available proof-of-concept, combined with the lack of authentication required to exploit this flaw, creates a high risk for any organization utilizing the Church Donation System. Administrators must treat this as a priority and implement stringent network-level access controls or WAF protections immediately, as no vendor-supplied patch is currently available to remediate the underlying code defect.