A SQL injection vulnerability in ATutor 2.2.4 allows authenticated administrators to perform unauthorized database operations, posing a significant risk to data integrity.

The application fails to properly sanitize input within the 'id' parameter of the admin_delete.php script. This flaw allows an authenticated attacker with administrative privileges to inject malicious SQL commands, potentially leading to unauthorized data extraction or modification.

Successful exploitation of this vulnerability could lead to the compromise of sensitive information stored within the application database. Given the CVSS score of 7.1, this is classified as a high-severity issue, as it permits an attacker to bypass standard database controls. The potential for unauthorized data manipulation poses a significant threat to both system integrity and regulatory compliance.

Immediate Action: As no official patch is currently identified for this legacy version, administrators should restrict access to the administrative panel to trusted IP addresses only. If the functionality is not required, disable the affected admin_delete.php script or the associated module.

Proactive Monitoring: Review web server and application logs for anomalous SQL syntax patterns or unexpected database query activity originating from administrative accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection patterns specifically targeting the 'id' parameter in the identified script.

Public Exploit Available: Yes, a functional exploit is available via Exploit-DB (EDB-ID 48117).

Given the availability of public exploit code and the high-severity nature of SQL injection, immediate mitigation is required. Organizations still utilizing ATutor 2.2.4 must implement the suggested compensating controls and restrict administrative access until a permanent patch or migration to a supported version can be performed.