A critical SQL injection vulnerability in SourceCodester Online Polling System 1.0 allows unauthenticated remote attackers to manipulate database queries.

The application is susceptible to SQL injection (CWE-89) due to improper sanitization of the ID argument within the admin/candidates.php file. This flaw is accessible to unauthenticated remote attackers.

The ability to perform unauthorized SQL injection can lead to the unauthorized disclosure, modification, or deletion of sensitive data stored within the application database. With a CVSS score of 7.3, this high-severity vulnerability poses a significant risk to data integrity and confidentiality, potentially leading to total system compromise if the database is not properly segmented.

Immediate Action: Since an official patch is not currently available, administrators should restrict network access to the admin/candidates.php endpoint or disable the affected module until a fix is released.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests containing SQL syntax patterns targeted at the admin/candidates.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting URL parameters.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked GitHub repository.

Given the availability of a public proof-of-concept and the unauthenticated nature of the exploit, this vulnerability requires immediate attention. Organizations utilizing SourceCodester Online Polling System 1.0 must implement strict access controls and WAF filtering to mitigate the risk of exploitation while awaiting a vendor-supplied security update.