A critical SQL injection vulnerability in code-projects Church Donation System 1.0 allows for remote, unauthenticated exploitation of the database.

The application is susceptible to SQL injection (CWE-89) within the Amount argument of the /members/giving.php file. The vulnerability is remotely exploitable without requiring user authentication.

The ability for an unauthenticated attacker to inject malicious SQL commands poses a significant risk to the integrity and availability of the underlying database. With a CVSS score of 7.3, this high-severity flaw could lead to unauthorized data access, potential modification of donation records, or loss of sensitive member information. Such a breach would likely result in reputational damage and potential regulatory non-compliance for the organization.

Immediate Action: As no official patch is currently available, administrators should immediately restrict network access to the affected /members/giving.php endpoint to authorized personnel only.

Proactive Monitoring: Security teams should review application access logs and database audit trails for anomalous query patterns or unusual characters associated with SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect incoming requests for SQL injection payloads and block traffic targeting the vulnerable argument.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability disclosure.

Given the public availability of exploit material and the lack of a vendor-provided patch, this vulnerability presents a clear and present danger to affected systems. Organizations must prioritize the implementation of compensating controls, such as WAF rules or network segmentation, to mitigate the risk until an official update is released. Failure to secure the vulnerable endpoint may expose the application to unauthorized database manipulation.