The itsourcecode Open Source Job Portal 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise database integrity.

This vulnerability is an SQL injection (CWE-89) flaw located in the file /jobportal/admin/company/index.php. An unauthenticated remote attacker can manipulate the ID parameter to execute arbitrary SQL commands against the backend database.

Successful exploitation of this flaw allows attackers to perform unauthorized database operations, potentially leading to data exfiltration, modification, or deletion. With a CVSS score of 7.3, this represents a high-severity risk that could compromise the confidentiality and integrity of applicant and company data stored within the portal.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /jobportal/admin/ directory using IP allowlisting or VPN authentication.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests containing SQL syntax patterns targeting the /jobportal/admin/company/index.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads in the ID query parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the security research documented at https://github.com/yihaofuweng/cve/issues/37.

Given the availability of a public proof-of-concept and the lack of a vendor patch, organizations must treat this vulnerability with urgency. If the Open Source Job Portal cannot be secured via network-level controls or a WAF, it should be taken offline until a secure version is released by the developer.