A critical SQL injection vulnerability in SourceCodester Online Book Store System allows unauthenticated attackers to compromise the backend database.

This is a SQL Injection vulnerability (CWE-89) that permits unauthenticated remote attackers to manipulate database queries, leading to unauthorized data access or authentication bypass.

SQL injection is a severe risk that can lead to the complete compromise of the database, including sensitive user information and administrative credentials. With a CVSS score of 7.3, this vulnerability represents a significant threat to business continuity and data privacy.

Immediate Action: Since this is a legacy or open-source system, review the codebase to implement parameterized queries to mitigate SQL injection.

Proactive Monitoring: Monitor database query logs for unusual syntax or high volumes of error-generating requests indicative of injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with SQL injection protection rules to block malicious payloads targeting the input fields.

Public Exploit Available: No

Given the high risk associated with SQL injection, administrators should prioritize sanitizing all user inputs within the application. If a formal patch is not provided by the vendor, custom remediation via code refactoring is essential to secure the database.