An unauthenticated SQL injection vulnerability in the code-projects Church Donation System allows remote attackers to execute arbitrary database queries, posing a significant risk of data compromise.

This is a SQL injection vulnerability (CWE-89) located in the Username parameter of the /members/search.php endpoint. The vulnerability is exploitable by an unauthenticated remote attacker.

Successful exploitation of this SQL injection flaw could allow unauthorized actors to access, modify, or delete data stored within the application database. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to a complete compromise of the system data, potential unauthorized access to member information, and significant reputational damage to the organization.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the application or disable the vulnerable /members/search.php functionality until a fix is released.

Proactive Monitoring: Review web server access logs for suspicious HTTP requests targeting the /members/search.php file, specifically looking for SQL syntax patterns or unexpected character strings in the Username parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and block malicious payloads directed at the vulnerable endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

This vulnerability presents a high risk due to its unauthenticated nature and the availability of public exploit information. Organizations currently running version 1.0 of the Church Donation System are strongly advised to isolate the application from the public internet or apply stringent WAF filtering immediately to prevent potential data exfiltration.