A critical SQL injection vulnerability in the code-projects Online Lot Reservation System allows unauthenticated attackers to bypass authentication and gain unauthorized access to the application.

The application is susceptible to SQL injection via the email and password parameters in the loginuser.php file. This flaw permits an unauthenticated attacker to manipulate database queries to bypass login mechanisms entirely.

The ability for an unauthenticated user to bypass authentication protocols poses a severe risk to data integrity and confidentiality. Successful exploitation allows unauthorized access to administrative or user accounts, potentially leading to full system compromise and the exposure of sensitive reservation data. With a CVSS score of 7.3, this high-severity vulnerability warrants immediate attention to prevent unauthorized data access and potential service disruption.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the loginuser.php endpoint or disable the affected module entirely until a secure update is released by the vendor.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous POST requests to loginuser.php, specifically identifying patterns involving SQL syntax characters like single quotes and comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the login parameters.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the security researcher's technical write-up provided in the referenced GitHub repository.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a significant risk to any organization running the Online Lot Reservation System. Organizations must prioritize the implementation of compensating controls, such as WAF filtering, and actively seek a secure replacement or vendor-supplied patch to mitigate the risk of unauthorized account takeover.