An unauthenticated SQL injection vulnerability in the Code-Projects Task Management System allows remote attackers to manipulate authentication queries, potentially leading to unauthorized access.

The application is vulnerable to SQL injection due to improper neutralization of special elements in the email parameter processed by the index.php login endpoint. An unauthenticated attacker can supply crafted SQL syntax to influence backend database queries.

The ability to perform SQL injection against an authentication endpoint poses a critical risk to data confidentiality and integrity. Successful exploitation could allow an attacker to bypass authentication, enumerate user accounts, or extract sensitive information from the underlying database. While the CVSS score is 7.3, the potential for total compromise of the application user database necessitates immediate attention.

Immediate Action: As no official patch is currently available, administrators should restrict access to the login interface using network-level controls or a Web Application Firewall until the vendor releases a secure update.

Proactive Monitoring: Review web server access logs for suspicious POST requests to index.php containing SQL syntax characters, such as single quotes, OR conditions, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block SQL injection patterns in HTTP POST parameters. Additionally, ensure that the database user account utilized by the application follows the principle of least privilege.

Public Exploit Available: Yes, a public proof-of-concept is available via the researcher's published write-up on GitHub.

Given the availability of a public proof-of-concept and the nature of the flaw, this vulnerability should be treated with high urgency. Organizations using this software must implement compensating controls immediately to prevent unauthorized access and monitor for signs of exploitation while awaiting a vendor-supplied patch.