An unauthenticated SQL injection vulnerability in code-projects Kitchen Treasure version 1.0 presents a significant risk to data integrity and confidentiality.

The application is susceptible to SQL injection via the email parameter in the userregistration.php file. This flaw allows an unauthenticated remote attacker to execute arbitrary database queries.

The ability for an unauthenticated user to perform SQL injection can lead to unauthorized access to sensitive user data, database modification, or complete compromise of the application backend. With a CVSS score of 7.3, this high-severity vulnerability poses a substantial risk to organizational security, potentially resulting in data breaches and loss of system integrity.

Immediate Action: As no vendor patch is currently available, administrators should restrict public access to the registration page or implement input validation and parameterized queries in userregistration.php to neutralize the injection vector.

Proactive Monitoring: Review web server and database logs for unusual SQL syntax patterns or unexpected query strings originating from the registration endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeted at registration forms.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up at https://github.com/wllovemy/cve/issues/16.

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability requires immediate attention. Organizations utilizing Kitchen Treasure version 1.0 should prioritize implementing the suggested compensating controls and monitor for vendor updates to address the underlying code flaw.