The News Portal Project 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to manipulate database queries.

This vulnerability is an SQL injection (CWE-89) occurring within the /newsportal/admin/edit-category.php file, where the Category argument is inadequately sanitized. An unauthenticated attacker can exploit this flaw remotely to inject malicious SQL commands into the application database.

The ability for an unauthenticated user to perform SQL injection poses a significant risk to data integrity and confidentiality. Successful exploitation could lead to unauthorized access to sensitive administrative data, potential modification of records, or the exposure of the underlying database contents. With a CVSS score of 7.3, this flaw represents a high risk that requires immediate attention to prevent data compromise.

Immediate Action: As no official patch is available, administrators should immediately restrict access to the /newsportal/admin/ directory by implementing IP whitelisting or requiring VPN authentication.

Proactive Monitoring: Security teams should monitor database logs for suspicious query patterns or unexpected input characters associated with SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection payloads targeting the Category parameter.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced at https://github.com/910biter/cve/issues/1.

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability presents a clear and present danger to affected systems. Organizations utilizing this software must prioritize restricting external access to the vulnerable administrative endpoint immediately while awaiting further guidance or a vendor-supplied security patch.