A critical SQL injection vulnerability in SourceCodester Online Bank Management System 1.0 exposes the application to remote database manipulation and potential data compromise.

The application is susceptible to SQL injection via the msg parameter in the feedback.php file. This vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N (Privileges Required: None).

Successful exploitation of this SQL injection vulnerability could allow an attacker to bypass authentication, access sensitive banking data, or modify database records. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant data breaches, regulatory non-compliance, and loss of customer trust. The ability for an unauthenticated user to interact with the database remotely necessitates immediate attention to prevent unauthorized system access.

Immediate Action: As no official patch is currently available, administrators should restrict access to the feedback.php file at the web server level or disable the feedback module entirely.

Proactive Monitoring: Review web server access logs for suspicious requests targeting feedback.php, specifically monitoring for patterns containing SQL syntax such as UNION, SELECT, or comment characters.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the msg parameter.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided in the referenced GitHub repository.

Due to the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to the integrity of the Online Bank Management System. Organizations using this software should prioritize isolating the affected component until a vendor-supplied security update is released and verified. Failure to apply these compensating controls may result in unauthorized database exposure.