The Online Product Reservation System 1.0 is susceptible to a critical unauthenticated SQL injection vulnerability that allows remote attackers to access and exfiltrate database contents.

This is a SQL injection vulnerability (CWE-89) stemming from the direct concatenation of user-supplied input from the transaction_id GET parameter into a database query within order_view.php. The vulnerability is exploitable by unauthenticated remote users due to a lack of input validation and the use of deprecated, insecure database functions.

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a severe risk to data confidentiality and integrity. Successful exploitation allows for the unauthorized extraction of sensitive information, including customer data and administrative credentials, which can lead to full system compromise. With a CVSS score of 7.3, this vulnerability represents a high-risk entry point that could lead to significant reputational damage and regulatory non-compliance.

Immediate Action: As no official vendor patch is currently available, administrators should restrict public access to the vulnerable order_view.php file or take the application offline until the code can be remediated.

Proactive Monitoring: Review web server access logs for anomalous GET requests containing SQL syntax or characters commonly associated with injection attempts, such as single quotes or comment markers.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection filtering rules to block malicious payloads targeting the transaction_id parameter before they reach the application.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the technical write-up provided by the vulnerability researcher.

The presence of a publicly available proof-of-concept, combined with the lack of authentication requirements, makes this a high-priority issue. Organizations utilizing this software must prioritize isolating the affected component immediately. Given the absence of a vendor-provided fix, developers should transition to using prepared statements with parameterized queries to eliminate the underlying injection flaw.