The itsourcecode COVID Tracking System 1.0 is vulnerable to an unauthenticated SQL injection attack, which could allow remote adversaries to manipulate the application database.

This vulnerability is a SQL injection (CWE-89) flaw located in the /admin/?page=zone endpoint, where the ID argument is insufficiently sanitized. An unauthenticated attacker can supply malicious input to this parameter to interact with the database remotely.

The ability for an unauthenticated user to perform SQL injection presents a severe risk to the confidentiality and integrity of the COVID Tracking System. With a CVSS score of 7.3, this high-severity vulnerability could lead to unauthorized data exfiltration, modification of patient or system records, or potential administrative account compromise, resulting in significant operational and privacy impacts.

Immediate Action: As no official vendor patch is currently confirmed, administrators should restrict network access to the /admin/ directory using IP allow-listing or VPN requirements to prevent unauthenticated access.

Proactive Monitoring: Review web server and database logs for suspicious query patterns, specifically looking for SQL syntax characters like single quotes or comment markers within the ID parameter of the zone page.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the ID parameter.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the technical write-up provided via the GitHub reference in the CVE record.

Given the availability of a public proof-of-concept and the ease of exploitation over the network, this vulnerability poses a significant risk to any organization hosting the COVID Tracking System. Organizations must immediately restrict access to the affected administrative endpoint and prioritize the implementation of WAF protections until a formal security update is released by the vendor.