The itsourcecode COVID Tracking System 1.0 is vulnerable to unauthenticated SQL injection, posing a critical risk of database compromise and unauthorized data access.

This is a SQL injection vulnerability (CWE-89) located in the /admin/?page=system_info endpoint. The application fails to sanitize the meta_value parameter, allowing an unauthenticated remote attacker to manipulate database queries.

Successful exploitation allows an attacker to gain unauthorized access to the underlying database. This can lead to sensitive data leakage, unauthorized data modification or deletion, and potential full system compromise, resulting in significant business disruption and reputational damage. While the CVSS score is 7.3, the ability for unauthenticated remote attackers to manipulate backend queries elevates the urgency of this finding.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the administrative interface immediately.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically looking for time-based blind SQL injection payloads containing sleep commands or unusual characters in the meta_value field.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block malicious SQL injection patterns targeting the /admin/?page=system_info endpoint.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the linked GitHub security issue.

Given the severity of SQL injection and the public availability of a proof-of-concept, this vulnerability must be treated as a high priority. Organizations using the COVID Tracking System should implement strict access controls and WAF rules immediately, as no vendor-provided patch exists to resolve the underlying code defect.