An unauthenticated SQL injection vulnerability in the itsourcecode COVID Tracking System 1.0 poses a critical risk of full database compromise and unauthorized data access.

The application is vulnerable to SQL injection (CWE-89) because it fails to properly sanitize the username parameter within the /admin/?page=user endpoint. This flaw allows an unauthenticated remote attacker to manipulate database queries to extract, modify, or delete sensitive information.

Successful exploitation allows an attacker to bypass authentication and gain unauthorized access to the underlying database. This could lead to a complete loss of confidentiality, integrity, and availability for the system, resulting in significant data leakage and potential disruption of critical tracking operations. Given the CVSS score of 7.3, this vulnerability represents a high-severity risk to organizational data security.

Immediate Action: Since no official vendor patch is currently available, administrators should restrict network access to the application or take the system offline until the code can be manually hardened.

Proactive Monitoring: Review web server and database access logs for suspicious patterns, such as unexpected time-based delays or anomalous SQL syntax, which may indicate active exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeted at the username parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability research.

The presence of a public proof-of-concept combined with the unauthenticated nature of this vulnerability necessitates immediate defensive action. Organizations utilizing the COVID Tracking System 1.0 must prioritize implementing network-level restrictions and WAF filtering to prevent exploitation while awaiting a permanent software update from the vendor.