A critical SQL injection vulnerability in code-projects Church Donation System 1.0 allows for unauthenticated remote exploitation, posing a significant risk to database integrity.

The application is susceptible to SQL injection via the new_password parameter in the /members/update_password_admin.php file, which can be triggered by an unauthenticated remote attacker.

Successful exploitation allows unauthorized interaction with the underlying database, potentially leading to data compromise or unauthorized administrative actions. Given the CVSS score of 7.3, this represents a significant security risk that could facilitate unauthorized access to sensitive donor or member information stored within the system.

Immediate Action: As no official patch is currently identified, restrict access to the affected script at the network or web server level and monitor for unauthorized access attempts.

Proactive Monitoring: Review web server and application logs for suspicious HTTP requests targeting the /members/update_password_admin.php endpoint, specifically looking for SQL syntax patterns in the new_password parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced security report.

The presence of a public proof-of-concept combined with the remote, unauthenticated nature of this flaw necessitates immediate attention. Organizations utilizing this software should prioritize restricting external access to the vulnerable endpoint until a formal security patch is released by the vendor.