An unauthenticated SQL injection vulnerability in Campcodes Advanced Online Voting Management System 1.0 poses a significant risk of unauthorized database interaction and data compromise.

This vulnerability is a SQL injection flaw (CWE-89) triggered via the ID argument in the /admin/candidates_edit.php file. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N (Privileges Required: None).

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate backend database queries, potentially leading to unauthorized data disclosure or modification. With a CVSS score of 7.3, this flaw represents a High severity risk, as it allows remote attackers to interact with the application database without requiring prior authentication.

Immediate Action: Since a specific patch is not currently available, administrators should immediately restrict access to the /admin directory using IP allowlisting or by implementing additional authentication layers at the web server level.

Proactive Monitoring: Review web server and database logs for anomalous SQL syntax, such as UNION statements or unexpected character escaping, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the ID parameter.

Public Exploit Available: Yes, a published proof-of-concept exists via the GitHub reference provided in the vulnerability disclosure.

The presence of a public proof-of-concept and the ease of remote exploitation make this vulnerability an immediate concern for organizations utilizing the Campcodes Advanced Online Voting Management System. Administrators must apply the recommended compensating controls immediately and monitor vendor channels for the release of a permanent security patch to fully remediate this risk.