A critical SQL injection vulnerability in SourceCodester Online Farm Management System 1.0 permits unauthenticated remote attackers to compromise database integrity.

This vulnerability is a SQL injection (CWE-89) flaw located within the /Login/login.php file. An unauthenticated attacker can exploit this by injecting malicious SQL commands into the uname parameter, which is processed without sufficient sanitization.

Successful exploitation of this vulnerability allows unauthorized access to the underlying database, potentially leading to the exposure of sensitive user credentials and application data. Given the CVSS score of 7.3, this flaw poses a significant risk to the confidentiality and integrity of the system, and it could serve as a precursor to further unauthorized system access or data exfiltration.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the application or deactivate the affected login module until a security update is released.

Proactive Monitoring: Review web server access logs for anomalous patterns in POST or GET requests directed at /Login/login.php, specifically searching for SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the uname parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability report.

The presence of a public proof-of-concept combined with the lack of authentication requirements makes this an urgent security concern. Organizations utilizing this software should prioritize network-level mitigations and monitor for any signs of exploitation while awaiting a formal patch from the vendor.