An unauthenticated SQL injection vulnerability in the code-projects Online Reviewer System 1.0 allows remote attackers to compromise the database integrity, confidentiality, and availability.

This vulnerability is a SQL injection (CWE-89) flaw located in the /login/index.php file. An unauthenticated remote attacker can manipulate the username or password arguments to execute arbitrary SQL commands against the backend database.

The ability for an unauthenticated attacker to inject malicious SQL commands poses a severe risk to data integrity and system security. Successful exploitation could lead to unauthorized access to sensitive user credentials, modification of application data, or total database compromise. Given the CVSS score of 7.3, this represents a high-severity risk that demands immediate attention to prevent potential service disruption or data exfiltration.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected login interface or consider disabling the service until a secure update is released by the vendor.

Proactive Monitoring: Security teams should review web server access logs for anomalous patterns in login requests, specifically looking for SQL syntax characters or unusual payload lengths in the username and password fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection filtering rules to inspect incoming traffic and block malformed requests targeting the login endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked research write-up on GitHub.

The presence of a public proof-of-concept for an unauthenticated SQL injection vulnerability makes this a high-priority risk. Organizations using code-projects Online Reviewer System 1.0 must implement immediate defensive measures, such as network segmentation or WAF rules, to mitigate the risk of unauthorized database access while awaiting an official vendor security update.