The Church Donation System 1.0 is vulnerable to remote SQL injection, which could allow an unauthenticated attacker to compromise system data.

This is a SQL injection vulnerability (CWE-89) affecting the login_admin.php script. The vulnerability allows an unauthenticated, remote attacker to inject malicious SQL commands via the Username parameter.

The ability to perform SQL injection without authentication poses a significant risk to the confidentiality and integrity of the application database. Successful exploitation could lead to unauthorized data access, modification, or administrative account compromise, which is consistent with its CVSS score of 7.3.

Immediate Action: As no official patch is currently available, administrators should restrict access to the login_admin.php endpoint using network-level controls or by disabling the affected functionality if it is not required for daily operations.

Proactive Monitoring: Review web server and database access logs for suspicious SQL syntax patterns or anomalies in the input provided to the Username field during authentication attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeted at the login_admin.php endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the referenced GitHub issue (https://github.com/n0name-yang/myCVE/issues/11).

Given that this vulnerability is remotely exploitable without authentication and has a publicly available proof-of-concept, it poses an elevated risk to the organization. Administrators must prioritize restricting access to the administrative login interface immediately and monitor for unauthorized interaction until the vendor provides a permanent security update.