A high-severity SQL injection vulnerability in SourceCodester Survey Application System 1.0 permits unauthenticated attackers to manipulate database queries, potentially leading to unauthorized data access or modification.

The application suffers from a SQL injection flaw in the save_user and update_user functions within LoginRegistration.php. An unauthenticated attacker can inject malicious SQL syntax into the fullname POST parameter, which is improperly concatenated into database queries.

Successful exploitation of this vulnerability allows an attacker to compromise the integrity and confidentiality of the application database. By injecting malicious SQL, an attacker may bypass authentication mechanisms, extract sensitive user information, or modify application records, leading to significant data loss or unauthorized administrative access. The CVSS score of 7.3 reflects the potential for serious impact on system security.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the vulnerable application and implement strict input validation on all user-supplied data.

Proactive Monitoring: Security teams should monitor web server logs for suspicious POST requests targeting LoginRegistration.php, specifically looking for SQL syntax patterns or unexpected timing delays in application responses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, such as UNION-based or time-based injection attempts, to provide virtual patching.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up by lakshayyverma.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a credible risk to any organization deploying the Survey Application System. Organizations are strongly encouraged to disable the application if it is not business-critical or to implement robust WAF filtering until the vendor provides a formal security update to remediate the underlying code flaw.