An unauthenticated remote SQL injection vulnerability in Campcodes Advanced Online Voting Management System 1.0 poses a significant risk to data integrity and system confidentiality.

The application is susceptible to SQL injection via the Username parameter in the /admin/login.php file. This flaw allows an unauthenticated attacker to inject malicious SQL commands, which are executed directly against the backend database.

The ability for an unauthenticated user to interact directly with the database via SQL injection presents a severe risk of unauthorized data exposure, potential modification of records, and unauthorized administrative access. With a CVSS score of 7.3, this high-severity vulnerability could lead to a complete compromise of the voting data and the underlying system, resulting in significant reputational damage and loss of operational trust.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /admin/login.php endpoint to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual characters within the Username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns targeting login endpoints.

Public Exploit Available: Yes, a public proof-of-concept exists and is attributed to the technical report hosted on GitHub at https://github.com/hbesljx/vul/issues/5.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability should be prioritized for mitigation. Organizations currently running Campcodes Advanced Online Voting Management System 1.0 must implement strict access controls and WAF filtering immediately until the vendor releases a security update addressing the improper input sanitization.