An unauthenticated SQL injection vulnerability in SourceCodester Online Voting System 1.0 allows remote attackers to execute arbitrary database commands, posing a critical risk to data integrity.

The application fails to properly sanitize the category parameter within the /voting/ajax.php endpoint, allowing unauthenticated remote attackers to inject malicious SQL queries directly into the backend database.

A successful exploit allows an unauthorized actor to bypass application logic, view sensitive data, modify database contents, or potentially gain administrative control over the underlying system. Given the CVSS score of 7.3, this vulnerability represents a high-severity risk that could lead to complete loss of confidentiality and integrity for the voting data, resulting in significant reputational damage and potential regulatory non-compliance.

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict access to the /voting/ajax.php endpoint or disable the affected voting functionality until a secure update is released.

Proactive Monitoring: Monitor web server and database logs for anomalous patterns, specifically looking for SQL syntax errors, unexpected use of time-based sleep functions, or unauthorized POST requests to the ajax.php script.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the category parameter.

Public Exploit Available: Yes, a functional proof-of-concept payload and technical analysis are publicly available via the referenced GitHub security issue.

The presence of a public proof-of-concept significantly elevates the risk of automated exploitation against exposed instances of the Online Voting System. Organizations currently running version 1.0 must treat this as a high-priority issue. If the software cannot be patched or the specific functionality disabled, it should be isolated from the public internet immediately to prevent unauthorized database access.