An unauthenticated SQL injection vulnerability in Sourceforge GPS Tracking System 2.12 allows remote attackers to bypass authentication and gain unauthorized system access.

The application is susceptible to an SQL injection vulnerability located in the login.php endpoint. By injecting malicious SQL commands into the username parameter via a crafted POST request, an unauthenticated attacker can manipulate database queries to bypass the login mechanism entirely.

Successful exploitation of this vulnerability permits unauthorized access to the application, which may lead to the compromise of sensitive tracking data or administrative control of the system. While the CVSS score of 8.2 reflects a high severity due to the ease of exploitation and the lack of required authentication, the primary business risk involves the potential for data exfiltration and loss of system integrity.

Immediate Action: As there is no official patch available from the vendor, administrators must restrict access to the login.php endpoint using network-level controls or by disabling the service until a secure version is deployed or the source code is manually patched to use prepared statements.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous POST requests to the login.php file, specifically looking for characters indicative of SQL injection such as single quotes, equal signs, or SQL keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block SQL injection patterns targeting the login parameters of the application.

Public Exploit Available: Yes, a functional proof-of-concept exists via the Exploit Database (EDB-ID 45816).

Given the availability of a public proof-of-concept and the critical nature of an authentication bypass, this vulnerability poses a significant risk to any exposed instance. Because no vendor patch is currently available, organizations are strongly advised to isolate the affected system from public networks or implement strict WAF filtering to prevent exploitation attempts until the software can be replaced or secured.