An unauthenticated SQL injection vulnerability in the News Portal Project allows remote attackers to execute arbitrary database commands, posing a significant risk to data integrity.

This is a SQL injection vulnerability (CWE-89) triggered by improper input validation of the Category argument within the /admin/add-category.php file. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N (Privileges Required: None).

Successful exploitation allows an attacker to interact directly with the backend database, which may lead to unauthorized data exposure, modification, or complete deletion of application records. With a CVSS score of 7.3, this high-severity flaw threatens the confidentiality and integrity of the application, potentially resulting in significant reputational damage and loss of administrative control over the portal.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /admin/ directory using network-level controls or web server authentication to prevent unauthenticated access.

Proactive Monitoring: Review web server and database logs for anomalous SQL syntax, such as UNION SELECT statements or unexpected character encoding patterns, directed at the /admin/add-category.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to mitigate the risk until a software update is released by the vendor.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability record.

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability requires immediate attention. Organizations utilizing the News Portal Project 1.0 must prioritize implementing the suggested compensating controls and restricting access to administrative endpoints until the vendor provides a secure update.