An unauthenticated SQL injection vulnerability in Code-Projects Content Management System 1.0 poses a critical risk of database compromise and potential authentication bypass.

The application fails to properly sanitize user input in the user_name parameter within the /NEWS-BUZZ/login.php endpoint. This allows an unauthenticated attacker to inject malicious SQL commands directly into the authentication query.

Successful exploitation of this vulnerability allows an attacker to manipulate backend database queries, potentially leading to unauthorized access, exfiltration of sensitive user credentials, or modification of application data. Given the CVSS score of 7.3, this flaw presents a high risk to data confidentiality and integrity, particularly since the vulnerable component resides on the public-facing login interface.

Immediate Action: As no official patch is currently available, administrators should restrict access to the login page via network-level controls or a VPN until the vendor releases a secure version.

Proactive Monitoring: Review web server access logs for anomalous POST requests to login.php containing SQL syntax characters, such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns in HTTP POST parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher write-up on GitHub.

Given the availability of public exploit documentation and the lack of a vendor-provided patch, users of this software must treat this as a high-priority risk. Administrators should immediately implement restrictive WAF policies and network segmentation to shield the login endpoint from unauthorized traffic until a permanent resolution is provided by the vendor.