The COVID Tracking System Using QR-Code is vulnerable to unauthenticated SQL injection, posing a significant risk of unauthorized database manipulation and data compromise.

This vulnerability is a SQL injection flaw located in the /cts/admin/?page=zone file, where the id parameter is processed in SQL queries without proper sanitization or validation, allowing unauthenticated attackers to execute arbitrary SQL commands.

The ability for an unauthenticated attacker to inject malicious SQL commands into the backend database can lead to unauthorized data access, modification, or deletion of sensitive health records. Given the CVSS score of 7.3, this high-severity vulnerability could result in severe reputational damage and regulatory non-compliance regarding the handling of sensitive COVID-related tracking data.

Immediate Action: As no official patch is currently available, administrators should immediately restrict network access to the affected administrative interface using a VPN or IP allowlisting.

Proactive Monitoring: Monitor database query logs for unusual syntax, such as unexpected UNION statements or unauthorized attempts to access system tables.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP request parameters.

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in the provided data.

Given the ease of exploitation for this unauthenticated SQL injection, organizations currently running version 1.0 of the ITSourcecode COVID Tracking System should treat this as a high-priority risk. Until a vendor patch is released, strict network segmentation and WAF-based filtering are essential to prevent potential compromise of the underlying database.