An unauthenticated SQL injection vulnerability in the itsourcecode Student Information Management System poses a significant risk to data integrity and confidentiality.

This is an SQL injection vulnerability (CWE-89) located in the file /admin/modules/instructor/index.php. An unauthenticated remote attacker can exploit this flaw by manipulating the ID parameter to execute arbitrary SQL commands.

Successful exploitation of this vulnerability allows unauthorized access to the underlying database, which may lead to the exfiltration of sensitive student data or the modification of application records. With a CVSS score of 7.3, this flaw presents a high risk to business operations, potentially resulting in severe reputational damage and non-compliance with data protection regulations.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/modules/instructor/ directory and implement strict input validation for all user-supplied parameters.

Proactive Monitoring: Monitor server logs for suspicious HTTP requests containing SQL syntax or unusual query patterns targeting the instructor index file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads before they reach the application layer.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the technical write-up provided in the referenced GitHub issue.

Given the availability of public exploit material, the risk of automated exploitation against this system is elevated. Organizations currently running this software should prioritize isolating the affected component and implementing robust network-level filtering to prevent unauthorized access until a vendor-supplied security update is released.