An unauthenticated SQL injection vulnerability in code-projects Hostel Management System 1.0 allows remote attackers to compromise database integrity and confidentiality.

This is a SQL injection vulnerability (CWE-89) located in the admin module of the application. An unauthenticated remote attacker can manipulate the ID parameter within the index.php file to execute arbitrary SQL commands.

The vulnerability carries a CVSS score of 7.3, indicating a high-severity risk. Successful exploitation could allow an attacker to read sensitive data, modify database entries, or bypass administrative authentication, leading to significant data loss or unauthorized control over the hostel management platform.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the administrative interface or take the affected application offline until the vendor provides a remediation.

Proactive Monitoring: Review web server access logs for suspicious requests targeting the /justines/admin/mod_comments/ directory, specifically looking for SQL syntax patterns in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting URL parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the referenced GitHub issue (https://github.com/yihaofuweng/cve/issues/27).

Given the availability of a public proof-of-concept and the ease of exploitation over the network, this vulnerability presents an urgent risk. Organizations using code-projects Hostel Management System 1.0 must prioritize the implementation of compensating controls or network segmentation to prevent unauthorized access while awaiting a vendor-supplied update.