A critical SQL injection vulnerability in the SourceCodester Online Voting System version 1.0 allows unauthenticated remote attackers to compromise the underlying database.

The application fails to properly sanitize the id parameter in the /ajax.php?action=delete_voting endpoint, which is processed directly in SQL queries. This flaw allows an unauthenticated attacker to manipulate database queries to perform unauthorized actions.

Successful exploitation of this vulnerability permits unauthorized access to the application database, potentially leading to sensitive data exfiltration, unauthorized modification of voting records, or full system compromise. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to the integrity and confidentiality of the voting system and its associated data.

Immediate Action: As no vendor patch is currently available, administrators should immediately restrict access to the application or take the service offline until a secure version is released.

Proactive Monitoring: Review web server and database logs for anomalous requests to /ajax.php, specifically searching for SQL injection patterns or unusual POST requests containing the id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the id parameter in the application.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the CVE record.

Given the availability of a public proof-of-concept and the lack of an official patch, this vulnerability presents an immediate risk to any deployment of the SourceCodester Online Voting System 1.0. Organizations should prioritize isolating the affected system from public networks and implement robust input validation or WAF protections to mitigate the risk of unauthorized database manipulation.