A critical SQL injection vulnerability in SourceCodester Online Student File Management System 1.0 exposes the application to remote database manipulation and unauthorized data access.

The application fails to properly sanitize the stud_no argument within the index.php file, which allows for remote, unauthenticated SQL injection. This flaw enables an attacker to interact directly with the backend database.

Successful exploitation of this vulnerability could lead to the unauthorized disclosure, modification, or deletion of sensitive student records stored within the database. Given the CVSS score of 7.3, this flaw poses a high risk to the confidentiality and integrity of the system, potentially resulting in severe reputational damage and data privacy violations.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected index.php endpoint or disable the application until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious input patterns, specifically looking for SQL syntax characters such as single quotes, double dashes, or UNION statements within the stud_no parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block common SQL injection payloads targeted at the stud_no parameter.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the linked GitHub repository.

Due to the availability of a public proof-of-concept, the risk of exploitation is elevated. Organizations currently running this software must treat this as a high priority, implement strict WAF filtering immediately, and monitor for any signs of database compromise while awaiting a vendor-supplied patch.