A critical SQL injection vulnerability in code-projects Content Management System 1.0 permits remote unauthenticated attackers to execute unauthorized database queries.

This vulnerability is a SQL injection flaw (CWE-89) located in the /admin/delete.php file. An unauthenticated attacker can exploit this by manipulating the del parameter to execute arbitrary SQL commands.

The ability for an unauthenticated attacker to inject SQL commands poses a severe risk to data integrity and confidentiality. Successful exploitation could lead to unauthorized access to the underlying database, potentially resulting in the exposure of sensitive user information or full system compromise. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent malicious data manipulation or extraction.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /admin/delete.php endpoint or disable the affected functionality.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual patterns targeting the /admin/delete.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts directed at the identified vulnerable endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up on GitHub (https://github.com/Limingqian123/CVE/issues/12).

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to affected installations. Administrators must prioritize the implementation of compensating controls or network-level restrictions immediately, as an official vendor patch is currently missing. Failure to mitigate this exposure may lead to unauthorized database access and potential system compromise.