A critical SQL injection vulnerability in SourceCodester Online Polling System 1.0 allows for remote, unauthenticated database manipulation and potential unauthorized access.

This vulnerability is a SQL injection flaw (CWE-89) triggered by improper input validation of the email argument within the /admin/manage-admins.php script. The vulnerability can be exploited remotely by an unauthenticated attacker to inject malicious SQL commands.

The ability to perform remote SQL injection allows an attacker to query, modify, or delete sensitive data stored within the application database. Given the CVSS score of 7.3, this represents a high-risk scenario that could lead to full compromise of user credentials, administrative access, or loss of data integrity. Such exposure poses significant risks to system availability and compliance obligations.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/manage-admins.php endpoint via network controls or disable the affected module entirely if it is not business-critical.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests containing SQL syntax patterns, such as UNION, SELECT, or OR 1=1, directed at the administrative management files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets configured to detect and block SQL injection payloads targeting input parameters.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the technical write-up provided by the vulnerability reporter at https://github.com/ganzhi-qcy/cve/issues/22.

Due to the availability of a public proof-of-concept and the ease of exploitation via unauthenticated remote access, this vulnerability requires immediate attention. Organizations utilizing version 1.0 of the Online Polling System should implement strict network-level access controls and monitor for signs of unauthorized database interaction until a vendor-supplied security update is released.