An unauthenticated SQL injection vulnerability in the SourceCodester Online Voting System version 1.0 poses a critical risk of unauthorized database access and potential system compromise.

This is a SQL injection vulnerability (CWE-89) located in the /ajax.php?action=save_user endpoint. An unauthenticated attacker can supply malicious input to the id parameter, which is processed by the backend database without sufficient sanitization or parameterization.

Successful exploitation allows an attacker to interact directly with the underlying database, leading to unauthorized data extraction, modification, or deletion of sensitive voter and user records. Given the CVSS score of 7.3, this high-severity flaw threatens the confidentiality and integrity of the application, potentially resulting in complete database compromise and severe reputational damage.

Immediate Action: As no official vendor patch is currently confirmed, administrators should restrict network access to the /ajax.php endpoint or disable the voting system until a secure version is released.

Proactive Monitoring: Review web server and database logs for anomalous activity, specifically looking for SQL syntax errors or unexpected POST requests directed at /ajax.php?action=save_user.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns and suspicious payloads targeting the id parameter.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the research write-up linked in the CVE record.

The severity of this SQL injection vulnerability necessitates immediate defensive action. Because the flaw allows for unauthenticated database manipulation, it is imperative that organizations prioritize restricting access to the affected script. We strongly advise monitoring the vendor's website for security updates and applying patches as soon as they become available to ensure the integrity of the voting data.