A critical SQL injection vulnerability in code-projects Hostel Management System 1.0 allows unauthenticated remote attackers to manipulate database queries.

The application fails to properly sanitize input for the log_email argument in the /justines/index.php endpoint, leading to SQL injection (CWE-89). This vulnerability is remotely exploitable without authentication.

The exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive database information, potential data exfiltration, or modification of application data. Given the CVSS score of 7.3, this represents a high risk to the confidentiality and integrity of the hostel management environment. Successful exploitation may result in significant operational disruption and loss of sensitive user or administrative data.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the affected /justines/index.php endpoint or disable the vulnerable module if it is not essential for business operations.

Proactive Monitoring: Security teams should monitor web server logs for suspicious URL parameters containing SQL syntax or unusual request patterns directed at the /justines/index.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection payloads targeting the application.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

Due to the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability poses a significant risk. Organizations currently using version 1.0 of the Hostel Management System must prioritize implementing WAF filtering and restricting network access to the vulnerable script until a vendor-supplied security update is released.