The code-projects Church Donation System version 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise database integrity.

This is a SQL injection vulnerability (CWE-89) located within the reg.php file. An unauthenticated attacker can supply malicious input via the mobile parameter to execute arbitrary SQL commands.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive donor information, modification of database records, or potential exfiltration of private data. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant data breaches and a loss of user trust. If the database user has elevated permissions, the impact could extend to full system compromise.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the reg.php endpoint or take the application offline until a secure version is released.

Proactive Monitoring: Security teams should monitor database logs for anomalous queries, especially those containing SQL syntax characters or unexpected patterns originating from the mobile parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeted at the application endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists via the GitHub repository referenced in the vulnerability documentation.

The presence of a public proof-of-concept combined with the lack of an available vendor patch necessitates immediate defensive measures. We strongly recommend isolating the affected system from public networks until the developer provides a remediation path. Continuous monitoring of application logs is essential to detect any unauthorized access attempts until a permanent fix is applied.