An unauthenticated SQL injection vulnerability in the itsourcecode COVID Tracking System 1.0 poses a significant risk of unauthorized data access and potential database compromise.

This vulnerability is a SQL injection (CWE-89) flaw located within the admin login interface at /admin/login.php. The application fails to properly sanitize the username input parameter, allowing an unauthenticated remote attacker to inject malicious SQL queries.

The ability for an unauthenticated attacker to inject SQL commands into a login component presents a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to administrative functions, extraction of sensitive tracking data, or complete compromise of the underlying database. With a CVSS score of 7.3, this high-severity vulnerability requires immediate attention to prevent potential service disruption or data breaches.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/login.php endpoint to trusted IP addresses only.

Proactive Monitoring: Monitor server logs for unusual HTTP requests targeting the login page, specifically looking for SQL syntax patterns or unexpected character sequences in the username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns to provide a virtual patch until the vendor releases a secure update.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided in the referenced GitHub issue.

Given the public availability of a proof-of-concept and the ease of remote exploitation, this vulnerability should be treated as a high priority. Organizations using the itsourcecode COVID Tracking System 1.0 must implement strict access controls and WAF filtering immediately to mitigate the risk of unauthorized database manipulation while awaiting a formal vendor security update.