An unauthenticated SQL injection vulnerability in code-projects Content Management System 1.0 enables remote attackers to compromise database integrity and access sensitive information.

This is a SQL injection vulnerability (CWE-89) located in the search.php file. An unauthenticated attacker can supply a malicious payload through the value GET parameter, which is processed by the database without adequate sanitization or parameterization.

Successful exploitation permits an attacker to execute arbitrary SQL commands, potentially leading to unauthorized data exfiltration, modification of application records, or complete compromise of the backend database. While the CVSS score of 7.3 reflects a high severity, the ability for an unauthenticated user to interact with the database remotely represents a significant risk to organizational data confidentiality and system integrity.

Immediate Action: As no official patch is available, immediately restrict access to the affected search.php endpoint or disable the search functionality until the vendor provides a secure update.

Proactive Monitoring: Review web server and database logs for anomalous GET requests containing SQL syntax, such as "UNION SELECT," "SLEEP," or Boolean-based blind injection patterns targeting the search.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns specifically targeting the value parameter in the application.

Public Exploit Available: Yes, a published proof-of-concept exists in the researcher's GitHub repository referenced by the CVE record.

Given the availability of a functional proof-of-concept and the lack of a vendor-supplied patch, administrators should prioritize isolating the vulnerable component. Organizations relying on this software must implement strict WAF filtering or disable the search module to prevent unauthorized database access while awaiting a formal resolution from the vendor.