The code-projects Online Farm System 1.0 contains a critical SQL injection vulnerability in the password recovery function that allows unauthenticated remote attackers to compromise the database.

This vulnerability is a SQL injection flaw (CWE-89) triggered by improper sanitization of the email argument within the forgot_pass.php script. The attack is unauthenticated, meaning no prior user access is required to execute the exploit.

Successful exploitation allows an unauthorized party to execute arbitrary SQL commands against the backend database. This risk includes potential data exfiltration, database structure modification, or unauthorized access to user accounts. Given the CVSS score of 7.3, this represents a high risk to data confidentiality and integrity, necessitating immediate attention.

Immediate Action: Since no official patch is currently available, administrators should restrict public access to the forgot_pass.php endpoint or disable the password recovery functionality until a fix is released.

Proactive Monitoring: Review web server access logs for anomalous requests to the forgot_pass.php file, specifically looking for SQL syntax patterns (such as OR, UNION, or comment characters) within the email parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection payloads targeting input fields in order to provide a virtual patch for the affected endpoint.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability record.

The presence of a public proof-of-concept combined with the unauthenticated nature of this vulnerability makes it a priority for remediation. Organizations currently running Online Farm System 1.0 should treat this as a high-risk exposure. We recommend isolating the affected application or implementing strict WAF filtering until the vendor provides a formal security update to address the underlying code flaw.