The Online Product Reservation System 1.0 contains a critical SQL injection vulnerability in its user registration process that allows unauthenticated remote attackers to compromise the database.

This vulnerability is a SQL injection (CWE-89) flaw located in the user registration handler file, specifically handgunner-administrator/register_code.php. The application fails to sanitize multiple user-supplied POST parameters before concatenating them into an INSERT query, which can be triggered by any unauthenticated remote attacker.

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a severe risk to the confidentiality, integrity, and availability of the application database. With a CVSS score of 7.3, this flaw enables unauthorized data extraction, modification of user records, or potential administrative account takeover, which could lead to significant reputational damage and loss of sensitive customer data.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the vulnerable registration endpoint or disable the affected registration functionality entirely until a secure update is provided by the vendor.

Proactive Monitoring: Security teams should monitor web access logs for anomalous POST requests directed at handgunner-administrator/register_code.php, specifically looking for SQL syntax patterns or unexpected character inputs.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and block malicious payloads targeting the registration form fields.

Public Exploit Available: Yes — a published proof-of-concept exists in the researcher write-up provided via the GitHub repository reference.

Given the availability of a public proof-of-concept, this vulnerability presents a high risk of exploitation by automated scanners and malicious actors. Organizations currently utilizing this software must implement immediate network-level mitigations or disable the vulnerable component to prevent unauthorized database access. Prioritize finding an alternative solution or applying a vendor-supplied patch the moment it is released.