A critical SQL injection vulnerability in the code-projects Wazifa System allows unauthenticated remote attackers to manipulate backend database queries, posing a significant risk of unauthorized data access.

This vulnerability is an improper neutralization of special elements used in an SQL command (CWE-89), specifically within the post parameter of the /controllers/postpublish.php file. The attack vector is network-based and requires no authentication, allowing for unauthenticated exploitation.

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk that could lead to unauthorized data exposure, modification, or potential loss of system integrity. Successful exploitation allows an attacker to interact directly with the underlying database, which may result in sensitive information disclosure or administrative account compromise, directly impacting business operations and data confidentiality.

Immediate Action: As no official patch is currently available, administrators should restrict access to the vulnerable /controllers/postpublish.php endpoint or disable the affected functionality until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected payloads directed at the post parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to mitigate exploitation attempts while waiting for a permanent fix.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the CVE record.

Given the availability of a public proof-of-concept and the ease of exploitation, immediate action is required to secure the environment. Organizations should prioritize isolating the affected Wazifa System instance from public networks and monitor for any signs of unauthorized database interaction until a vendor-authorized patch is applied.