An unauthenticated SQL injection vulnerability in SourceCodester Survey Application System 1.0 poses a critical risk of data exfiltration and unauthorized database access.

The application is vulnerable to time-based blind SQL injection in the view_survey.php file, where the id GET parameter is directly interpolated into a database query without proper sanitization. This allows an unauthenticated remote attacker to infer database contents by measuring query response delays.

Successful exploitation of this vulnerability permits unauthorized access to the underlying database, potentially leading to the compromise of sensitive survey data and administrative credentials. Given the CVSS score of 7.3, this flaw represents a significant risk to data confidentiality and integrity, particularly because it requires no authentication to execute.

Immediate Action: As no official vendor patch is currently available, administrators should restrict public access to the vulnerable view_survey.php endpoint or disable the application entirely until a fix is provided.

Proactive Monitoring: Security teams should monitor web server logs for suspicious GET requests containing SQL-like syntax or unusual delay patterns associated with the id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, specifically targeting time-based payloads like sleep() or benchmark() functions.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the linked research write-up on GitHub.

This vulnerability presents a clear path for unauthorized data exfiltration with minimal effort. Organizations currently utilizing SourceCodester Survey Application System 1.0 must prioritize isolating these instances from public-facing networks until a secure update is verified, as the availability of a public proof-of-concept significantly lowers the bar for potential attackers.