A critical SQL injection vulnerability in itsourcecode Online Voting System 1.0 allows remote, unauthenticated attackers to compromise database integrity.

This vulnerability is a SQL injection flaw (CWE-89) located in the login.php file. The application fails to properly sanitize the Username argument, enabling an unauthenticated remote attacker to execute arbitrary SQL commands.

The ability to perform unauthenticated SQL injection poses a significant risk to the confidentiality, integrity, and availability of the voting database. With a CVSS score of 7.3, this high-severity flaw could allow an attacker to bypass authentication, extract sensitive user information, or modify voting records, leading to severe reputational damage and loss of trust in the system.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the login portal and evaluate the necessity of the application until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous patterns in the Username field, specifically looking for SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and block malicious payloads directed at the login.php endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the linked GitHub issue.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations utilizing the itsourcecode Online Voting System 1.0 must prioritize the implementation of compensating controls, such as WAF rules, and maintain heightened monitoring until an official patch is provided by the vendor.