A critical SQL injection vulnerability in the SourceCodester Online Polling System allows unauthenticated remote attackers to compromise database integrity.

The application is susceptible to SQL injection via the email parameter in the /manage-profile.php file. This flaw permits unauthenticated remote attackers to inject malicious SQL commands, potentially leading to unauthorized data access or modification.

The exploitation of this SQL injection vulnerability poses a significant risk to data confidentiality and integrity. An attacker could extract sensitive user information or modify polling data, potentially leading to reputational damage and loss of trust in the platform. Given the CVSS score of 7.3, this issue represents a high-severity risk that requires immediate attention to prevent unauthorized database interactions.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /manage-profile.php file or disable the affected functionality until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns targeting the /manage-profile.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection payloads in HTTP GET or POST requests.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository.

Due to the availability of a public proof-of-concept and the lack of an official patch, this vulnerability presents an elevated risk. Organizations utilizing SourceCodester Online Polling System 1.0 must immediately implement compensating controls or restrict access to the vulnerable components to prevent potential exploitation. Monitoring for suspicious activity is essential until the vendor provides a permanent fix.