The Online Product Reservation System 1.0 contains an unauthenticated SQL injection vulnerability that allows attackers to bypass authentication and access sensitive user data.

The application is vulnerable to SQL injection within the app/user/login.php file, where the emailadd parameter is concatenated directly into a database query without validation. This allows an unauthenticated attacker to manipulate the authentication logic and execute arbitrary SQL commands.

The exploitation of this vulnerability leads to a complete bypass of the authentication mechanism, granting unauthorized access to the application as a legitimate user or administrator. Given the CVSS score of 7.3, this flaw presents a high risk for data exfiltration and potential compromise of the underlying database. The use of deprecated database functions and MD5 hashing further exacerbates the risk to user credentials and overall system integrity.

Immediate Action: As no official patch is currently available, administrators should restrict access to the login portal using network-level controls or immediately disable the affected module.

Proactive Monitoring: Review web server access logs for anomalous POST requests to app/user/login.php containing SQL syntax characters, such as single quotes or OR statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to filter malicious input targeting the emailadd parameter.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the technical write-up provided in the vulnerability references.

This vulnerability represents a significant security risk due to the ease of authentication bypass and the availability of public proof-of-concept code. Organizations using the Online Product Reservation System 1.0 must prioritize restricting public access to the login endpoint until the vendor provides a secure update. Immediate implementation of WAF rules is strongly advised to mitigate the risk of unauthorized access.