An unauthenticated SQL injection vulnerability in the code-projects Online Ordering System 1.0 allows remote attackers to compromise the underlying database.

This is a SQL injection vulnerability (CWE-89) triggered by the improper sanitization of the Name argument within the /admin/product.php file. The vulnerability is remotely exploitable without authentication, as indicated by the CVSS vector (AV:N/PR:N).

The ability for an unauthenticated attacker to inject malicious SQL commands poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive customer or system information, potential modification of database records, or total system compromise. While the CVSS score of 7.3 reflects a high severity, the risk is further elevated by the remote, unauthenticated nature of the attack vector.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin/product.php endpoint or disable the affected module entirely until a secure version is released.

Proactive Monitoring: Monitor database query logs for suspicious syntax or unexpected patterns, particularly those originating from the /admin/product.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block common SQL injection patterns targeting the Name parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up at the following GitHub issue: https://github.com/xiajian-qx/cve-xiajian/issues/4.

Given the availability of a public proof-of-concept and the lack of an official patch, this vulnerability presents a significant risk to organizations running the Online Ordering System. Immediate steps must be taken to isolate the vulnerable component or implement strict WAF filtering to prevent unauthorized database access. Prioritize this remediation to ensure the continued security of your application environment.