An unauthenticated SQL injection vulnerability in code-projects Online Farm System 1.0 exposes the application to remote database manipulation and potential data compromise.

This vulnerability is a SQL injection flaw (CWE-89) located in the register.php script. An unauthenticated attacker can exploit this by injecting malicious SQL commands into the Username parameter during the registration process.

Successful exploitation of this flaw allows an attacker to interact directly with the backend database. This may lead to unauthorized data extraction, modification of user records, or potential bypass of authentication mechanisms. Given the CVSS score of 7.3, this represents a significant risk to data integrity and system confidentiality.

Immediate Action: As no official patch is currently available, administrators should restrict access to the registration endpoint or disable the registration functionality until a vendor update is released.

Proactive Monitoring: Review web server access logs for anomalous characters or SQL syntax patterns directed at the register.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting registration forms.

Public Exploit Available: Yes — a published proof-of-concept exists and is documented in the referenced GitHub issue.

The presence of a public proof-of-concept makes this vulnerability an immediate concern for any exposed instances of Online Farm System 1.0. Organizations should prioritize implementing WAF filtering and restricting public access to the vulnerable registration page while awaiting an official security update from the vendor.