A critical SQL injection vulnerability in itsourcecode COVID Tracking System 1.0 allows unauthenticated remote attackers to compromise database integrity and potentially access sensitive information.

The application fails to properly sanitize user input within the code argument of the login.php file. This flaw permits unauthenticated remote attackers to perform SQL injection attacks against the underlying database.

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized data exfiltration, modification of tracking records, or potential administrative bypass, significantly impacting the operational security of the system. With a CVSS score of 7.3, this high-severity vulnerability necessitates immediate attention to prevent unauthorized access to the tracking database.

Immediate Action: Since an official patch is currently unknown, administrators should restrict access to the login.php endpoint using network-level controls or by disabling the service until the vendor provides a remediation.

Proactive Monitoring: Review web server access logs for anomalous requests to login.php containing SQL syntax characters, such as single quotes or comment indicators, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection patterns targeting the login.php script.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the GitHub issue reported in the vulnerability references.

Given the availability of a public proof-of-concept and the lack of an official patch, this vulnerability represents an immediate risk to the affected system. Security teams should prioritize isolating the application from external networks and implementing strict input validation or WAF rules to mitigate the threat of SQL injection until a formal vendor update is released.