An authenticated SQL injection vulnerability in Tripath Project eLection 2.0 allows attackers to execute arbitrary commands on the underlying server, posing a critical risk to system integrity.

The application is vulnerable to SQL injection via the id parameter in the admin candidate management endpoint (op_kandidat.php). This flaw requires low-level administrative authentication to trigger, but it enables attackers to execute arbitrary system commands by uploading malicious files to the web directory.

Successful exploitation of this vulnerability allows an attacker to achieve full remote code execution on the host server. Given the CVSS score of 7.1, this represents a high-severity risk that could lead to complete system compromise, unauthorized data access, and potential lateral movement within the network.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the administrative portal to trusted IP addresses only and disable the affected candidate management features if they are not mission-critical.

Proactive Monitoring: Monitor server logs for anomalous POST requests to the /election/admin/ajax/op_kandidat.php endpoint, particularly those containing SQL syntax or attempts to access newly created .php files in the web root.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the id parameter in administrative requests.

Public Exploit Available: Yes, a functional proof-of-concept and technical write-up are available via ExploitDB and GitHub.

Given the availability of public exploits and the catastrophic potential for remote code execution, this vulnerability demands immediate attention. Organizations currently utilizing eLection 2.0 should isolate the application from the public internet or decommission it until a secure alternative or vendor patch is provided.