The Online Reviewer System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise the application database.

This vulnerability is a SQL injection flaw (CWE-89) located in the login index file. It allows an unauthenticated attacker to inject malicious SQL commands via the Username parameter.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive application data, potential modification of database records, or a complete compromise of the backend database. With a CVSS score of 7.3, this represents a high-severity risk that could result in significant data breaches and loss of system integrity.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the login portal via network-level controls or consider disabling the service until a fix is provided by the vendor.

Proactive Monitoring: Review application logs for anomalous SQL syntax or unexpected character patterns in login requests, particularly those targeting the Username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rulesets designed to detect and block common SQL injection patterns in HTTP requests.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of exploitation through the login interface, this vulnerability poses a significant risk to affected systems. Organizations should prioritize isolating the affected component from the public internet and implementing robust input validation or WAF protections while awaiting a formal vendor security update.