The vulnerability affects SourceCodester Photo Share Website 1.0 in the signup AJAX functionality. Specifically, the email argument in the /social/ajax.php?action=signup endpoint is not properly sanitized, allowing an attacker to perform SQL injection. This can lead to unauthorized database queries and potential data exposure or modification. Remote exploitation is possible without any privileges or user interaction. Public exploit code is available, increasing the risk of exploitation. No official patch or remediation guidance has been provided by the vendor as of the publication date.

Successful exploitation allows an unauthenticated remote attacker to inject SQL commands via the email parameter during signup. This can lead to unauthorized access to or manipulation of the backend database. The exact impact depends on the database schema and privileges but may include data leakage, data corruption, or further compromise of the application. The medium CVSS score reflects the moderate risk due to remote exploitability and potential data impact, but no evidence of active exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the email parameter in the signup process to prevent SQL injection. Monitoring for suspicious activity targeting the signup endpoint may also help detect exploitation attempts.