The Student Information Management System version 1.0 is vulnerable to a remote SQL injection flaw that permits unauthenticated attackers to potentially compromise database integrity.

The application is susceptible to CWE-89 (SQL Injection) within the /admin/modules/class/index.php file. The vulnerability is triggered by an unauthenticated remote attacker through the manipulation of the classId argument.

Successful exploitation of this SQL injection vulnerability allows an attacker to interact directly with the backend database. This may lead to unauthorized data disclosure, modification of student records, or administrative bypass, severely impacting the confidentiality and integrity of institutional data. The CVSS score of 7.3 reflects the significant risk posed by this remote, unauthenticated attack vector.

Immediate Action: As no official patch is currently available, administrators should immediately restrict network access to the /admin/ directory and implement strict input validation for all parameters.

Proactive Monitoring: Security teams should monitor web server logs for suspicious URL patterns, particularly those involving the classId parameter or attempts to inject SQL syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to provide a virtual patch until an official update is released.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the linked GitHub repository.

Given the availability of a public proof-of-concept and the ease of exploitation via unauthenticated remote access, this vulnerability presents a high risk to the affected environment. Administrators must prioritize the implementation of compensating controls, such as WAF rules or network segmentation, to mitigate the risk of exploitation while awaiting a vendor-supplied update.