A remote SQL injection vulnerability in code-projects Wazifa System version 1.0 poses a significant risk of unauthorized database manipulation.

This vulnerability is a SQL Injection (CWE-89) flaw within the /controllers/updatesettings.php file. It allows an unauthenticated remote attacker to inject malicious SQL commands through the Password parameter, potentially compromising the integrity of the backend database.

The ability for an unauthenticated attacker to perform SQL injection can lead to the unauthorized disclosure, modification, or deletion of sensitive application data. Given the CVSS score of 7.3, this represents a high-severity risk that could result in significant data breaches, loss of system integrity, and potential administrative account compromise within the Wazifa platform.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the vulnerable endpoint and consider disabling the affected functionality until a vendor update is released.

Proactive Monitoring: Monitor database query logs for unusual patterns, such as unexpected syntax or commands originating from the /controllers/updatesettings.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the Password parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue (https://github.com/wllovemy/cve/issues/14).

Due to the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability presents an immediate and credible threat. Organizations currently utilizing Wazifa System 1.0 must prioritize the implementation of compensating controls, such as WAF filtering, to mitigate the risk of unauthorized database access until an official security update is provided by the vendor.