A critical SQL injection vulnerability in the SourceCodester Online Student File Management System allows remote unauthenticated attackers to compromise database integrity.

This vulnerability consists of a SQL injection flaw located in the /admin/index.php file. An unauthenticated attacker can inject malicious SQL commands via the Username parameter to interact with the backend database.

Successful exploitation allows an attacker to manipulate database queries, potentially leading to unauthorized data access, modification, or deletion. Given the CVSS score of 7.3, this flaw presents a significant risk to the confidentiality and integrity of student records stored within the system.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /admin/index.php endpoint or disable the affected module until a vendor-supplied update is released.

Proactive Monitoring: Monitor server access logs for suspicious patterns in the Username field, such as SQL syntax characters or unexpected query structures, which may indicate exploitation attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection filtering rules to inspect incoming traffic and block malicious payloads directed at the vulnerable parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up at the provided GitHub reference.

Given the availability of a public proof-of-concept and the lack of a vendor patch, this vulnerability poses an immediate risk to the application. Security teams must prioritize isolating the affected system and implementing compensating controls to prevent unauthorized database access until a formal remediation is provided by the vendor.