A SQL injection flaw in the code-projects Task Management System allows unauthenticated attackers to interact with the backend database, risking data integrity.

The application is susceptible to SQL injection (CWE-89) because it fails to properly sanitize user-supplied input before using it in database queries. This vulnerability is accessible to unauthenticated attackers over the network.

Successful exploitation permits an attacker to read, modify, or delete sensitive information stored within the application database. With a CVSS score of 7.3, this vulnerability threatens the confidentiality and integrity of project data, which could lead to significant operational disruption or the exposure of proprietary information.

Immediate Action: Since a formal patch is currently unavailable, users should restrict network access to the application or consider disabling the software until a secure update is released by the vendor.

Proactive Monitoring: Inspect web application logs for suspicious query strings or patterns indicative of SQL injection attempts, such as unexpected characters or database syntax in input fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads before they reach the application.

Public Exploit Available: Unknown.

The Task Management System should be removed from public-facing exposure immediately. Organizations using this software should transition to a more secure alternative or implement strict WAF filtering until the vendor provides a version that includes the necessary security fixes.