A critical SQL injection vulnerability in SourceCodester Food Ordering Management System 1.0 allows unauthenticated remote attackers to manipulate database queries.

The application fails to properly sanitize input in the phone argument within the /routers/register-router.php file, resulting in a SQL injection vulnerability. This flaw is exploitable by unauthenticated remote attackers.

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk. Successful exploitation could allow an attacker to bypass authentication, access sensitive database information, or modify application data, potentially leading to unauthorized administrative access and significant loss of data integrity.

Immediate Action: As there is no official patch available, administrators should immediately restrict access to the affected register-router.php endpoint and consider disabling the registration functionality until a secure update is released.

Proactive Monitoring: Security teams should monitor web server and database logs for anomalous SQL syntax or unexpected input patterns targeting the registration router.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block malicious payloads containing SQL injection vectors targeting the phone parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability disclosure.

Given the availability of a public proof-of-concept and the high impact of SQL injection, this vulnerability poses a substantial risk to any organization running this software. Organizations should prioritize isolating the affected system from public networks or implementing strict WAF filtering until the vendor provides a formal security update.