The code-projects Online Ordering System 1.0 is vulnerable to remote SQL injection, which could allow unauthenticated attackers to compromise database integrity.

This is a SQL injection vulnerability (CWE-89) located in the /admin/delete_member.php file. An unauthenticated attacker can supply malicious input to the ID argument to execute arbitrary SQL commands.

The ability to perform SQL injection allows an unauthenticated party to potentially read, modify, or delete sensitive data within the application database. With a CVSS score of 7.3, this represents a high-severity risk that could lead to unauthorized access to user information, system compromise, or complete data loss.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin/ directory using network-level controls or web server authentication. If the software is not mission-critical, consider disabling the affected service until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns targeting the delete_member.php endpoint. Monitor database query logs for unexpected delete or select operations originating from unauthorized sessions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts. Ensure that input validation is enforced at the application layer to sanitize all parameters passed to backend scripts.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research submission at https://github.com/xiajian-qx/cve-xiajian/issues/5.

Given the availability of a public proof-of-concept and the lack of a vendor patch, this vulnerability poses a significant risk to the confidentiality and integrity of the system. Organizations currently using this software must prioritize isolating the affected component and implementing strict access controls to prevent exploitation until a formal security update is provided.