An unauthenticated SQL injection vulnerability in the SourceCodester Responsive E-Learning System allows remote attackers to compromise database integrity and potentially access sensitive information.

The application fails to properly sanitize the Username parameter within the admin/add_teacher.php script, which allows unauthenticated remote attackers to execute arbitrary SQL commands. This flaw is categorized under CWE-89, indicating a failure to neutralize special elements used in an SQL command.

The vulnerability carries a CVSS score of 7.3, reflecting a High severity rating due to the ease of remote exploitation without authentication. Successful exploitation may lead to unauthorized data exfiltration, modification of administrative records, or complete compromise of the application database, resulting in significant operational disruption and loss of confidentiality.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin directory to trusted IP addresses only or disable the vulnerable E-Learning System until a vendor-supplied security update is released.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as SQL syntax characters (e.g., single quotes, union, select) originating from the /admin/add_teacher.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection payloads targeting the identified parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the lack of a vendor patch, this vulnerability poses a significant risk to any environment hosting the Responsive E-Learning System. Organizations must prioritize immediate isolation of the affected component and implement strict perimeter controls to prevent unauthorized access until a permanent fix is provided by the vendor.