A remote SQL injection vulnerability in SourceCodester Online Polling System 1.0 allows unauthenticated attackers to potentially compromise database integrity.

This vulnerability is a SQL injection flaw (CWE-89) triggered via the email parameter in the registeracc.php script. The attack vector is network based and requires no authentication, allowing an attacker to inject malicious SQL commands directly into the application database.

The exploitation of this vulnerability could lead to unauthorized access to sensitive user data, potential modification of polling results, or complete database compromise. With a CVSS score of 7.3, this flaw represents a significant risk to the confidentiality and integrity of the application, potentially resulting in reputational damage and loss of administrative control over the polling system.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the affected registeracc.php file or take the service offline until a secure version is released.

Proactive Monitoring: Security teams should monitor database logs for anomalous query patterns, such as unexpected SQL syntax errors or attempts to extract system table information.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application.

Public Exploit Available: Yes, a public proof-of-concept has been disclosed via the vulnerability research repository at https://github.com/ganzhi-qcy/cve/issues/20.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a credible threat to any organization hosting the Online Polling System. Organizations must prioritize limiting exposure by disabling the vulnerable component or implementing strict WAF filtering until the vendor provides a formal security update.