An unauthenticated SQL injection vulnerability in the itsourcecode Student Information Management System 1.0 poses a significant risk to database integrity and unauthorized data access.

This vulnerability involves an improper neutralization of special elements used in an SQL command (CWE-89) within the /admin/login.php file. The flaw is exploitable remotely by an unauthenticated attacker via manipulation of the uname parameter.

The ability for an unauthenticated attacker to inject arbitrary SQL commands into the application database creates a severe risk of unauthorized data exposure, modification, or potential administrative account takeover. With a CVSS score of 7.3, this high-severity flaw represents a critical threat to the confidentiality and integrity of student records and system administrative credentials.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the login portal and investigate the feasibility of disabling the affected module.

Proactive Monitoring: Review web server access logs for anomalous patterns in the uname field and monitor database logs for suspicious query structures characteristic of SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the /admin/login.php endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the security researcher's submission on GitHub.

Given the public availability of exploit material and the lack of a vendor-supplied patch, this vulnerability must be treated with high urgency. Organizations using version 1.0 should prioritize the implementation of robust WAF filtering and strict network segmentation to limit exposure while awaiting a formal security update from the vendor.