A critical SQL injection vulnerability in the itsourcecode Web-Based Internet Laboratory Management System allows unauthenticated remote attackers to compromise database contents.

The application fails to sanitize the user_email parameter within the User::AuthenticateUser function in login.php, enabling an unauthenticated attacker to execute arbitrary SQL queries via time-based blind injection.

Successful exploitation allows an unauthorized party to bypass authentication and extract sensitive information from the backend database, such as administrator usernames and password hashes. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and system integrity, potentially leading to a complete compromise of the laboratory management environment.

Immediate Action: Since a formal vendor patch is currently unknown, administrators should restrict access to the login.php endpoint using network-level controls or by disabling the affected module until a fix is provided by the vendor.

Proactive Monitoring: Review web server and application access logs for unusual patterns in the user_email parameter, specifically looking for characters indicative of SQL injection such as single quotes, comments, or sleep commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the login interface.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the referenced GitHub repository.

The presence of a publicly available proof-of-concept increases the likelihood of exploitation by malicious actors. Organizations currently running version 1.0 of the Web-Based Internet Laboratory Management System must treat this as a priority, implementing WAF protections immediately and monitoring for unauthorized database access attempts until a secure version is released.