A critical SQL injection vulnerability in the Code-Projects Simple Food Order System 1.0 enables remote, unauthenticated attackers to compromise database integrity and access sensitive data.

The application fails to properly sanitize the name parameter within the register-router.php script before incorporating it into database queries. This flaw allows an unauthenticated remote attacker to perform SQL injection attacks to manipulate database operations.

Successful exploitation of this vulnerability can lead to unauthorized database access, sensitive data exfiltration, and potential system-wide compromise. Given the CVSS score of 7.3, this flaw presents a high risk to business operations, as it allows attackers to bypass security controls to read, modify, or destroy information stored within the application database.

Immediate Action: As no official patch is currently available, administrators should restrict access to the register-router.php endpoint or disable the registration functionality if it is not business-critical until a vendor update is released.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically looking for SQL keywords or time-based delay signatures associated with the name parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming POST requests containing SQL injection payloads targeting the name parameter.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the referenced GitHub issue.

The presence of a publicly available proof-of-concept combined with the lack of authentication requirements makes this vulnerability a significant risk. Organizations utilizing the Simple Food Order System 1.0 must prioritize the implementation of compensating controls, such as WAF filtering, and actively monitor for unauthorized database activity until a formal security update is provided by the vendor.