A remote SQL injection vulnerability in SourceCodester Online Bank Management System 1.0 poses a significant risk of unauthorized database access and manipulation.

This is a SQL injection flaw (CWE-89) located in the /bank/show.php file. An unauthenticated remote attacker can exploit this by injecting malicious SQL commands into the ID parameter.

Successful exploitation allows an attacker to interact directly with the backend database, which may lead to the unauthorized disclosure or modification of sensitive banking data. Given the CVSS score of 7.3, this vulnerability represents a high risk to data integrity and confidentiality that could result in severe reputational damage or regulatory non-compliance.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /bank/show.php endpoint and implement strict input validation for the ID parameter.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as unexpected SQL syntax or URL-encoded payloads targeting the ID argument in the application path.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block common SQL injection patterns to mitigate the risk of remote exploitation.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked GitHub repository (https://github.com/CVE-Hunter-Leo/CVE/issues/7).

Due to the availability of a public proof-of-concept and the critical nature of banking software, this vulnerability requires immediate attention. Organizations utilizing this system must prioritize restricting external access to the vulnerable components and implement robust input sanitization until the vendor provides a formal security update.