An unauthenticated SQL injection vulnerability in the code-projects Smart Parking System allows remote attackers to compromise database integrity and potentially access sensitive files.

The application is susceptible to SQL injection via the /parkings/parkings.php script. Unauthenticated remote attackers can manipulate parameters such as 'street', 'city', or 'status' to inject malicious SQL commands, leading to unauthorized database interaction.

With a CVSS score of 7.3 (High), this vulnerability poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to the application’s backend database, potentially resulting in the exfiltration of sensitive information or the exposure of arbitrary files on the host system.

Immediate Action: Contact the vendor for official security patches. In the absence of a vendor-provided update, restrict network access to the application to trusted IP addresses only.

Proactive Monitoring: Review web server and database access logs for anomalous query patterns, specifically looking for SQL syntax characters (e.g., ', --, UNION) in input parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection patterns targeting the identified parameters.

Public Exploit Available: True

Given the High severity rating and the presence of public exploit scripts, administrators should prioritize securing this application immediately. If an official patch is not available, implement strict input validation and WAF filtering to prevent exploitation until a permanent remediation can be applied.