A critical SQL injection vulnerability in the itsourcecode News Portal Project 1.0 allows unauthenticated remote attackers to compromise the underlying database.

The application fails to properly sanitize the pagetitle parameter within the /admin/contactus.php script before incorporating it into database queries. This flaw allows an unauthenticated attacker to manipulate SQL queries, leading to unauthorized data access or system compromise.

The ability for an unauthenticated user to inject arbitrary SQL queries poses a severe risk to business operations. Attackers can exfiltrate sensitive information, modify or delete critical records, and potentially gain full control over the database, leading to significant data breaches, loss of customer trust, and operational downtime. While the CVSS score is 7.3, the potential for total database compromise warrants immediate attention.

Immediate Action: As no vendor-provided patch is currently available, administrators should immediately restrict access to the /admin/contactus.php endpoint or disable the affected module until a fix is released.

Proactive Monitoring: Security teams should review web server access logs for anomalous POST requests to the contactus.php file, specifically looking for SQL-related syntax patterns or time-based delay indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads targeting the pagetitle parameter.

Public Exploit Available: Yes — a published proof-of-concept exists, documented in the security researcher's write-up on GitHub.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability represents a significant threat to environments running the News Portal Project. Organizations should prioritize isolating the affected application from public networks and implement strict input validation controls. If the application cannot be patched or adequately protected by a WAF, it should be decommissioned to prevent unauthorized database access.