A critical SQL injection vulnerability in code-projects Hostel Management System 1.0 allows for remote, unauthenticated database manipulation and potential data compromise.

This vulnerability is a SQL injection flaw (CWE-89) located in the file /justines/admin/mod_amenities/index.php. An unauthenticated attacker can exploit this by injecting malicious SQL commands into the ID argument to interact directly with the backend database.

The ability to perform unauthenticated SQL injection poses a significant risk to the confidentiality and integrity of the application database. With a CVSS score of 7.3, this flaw could allow unauthorized actors to extract sensitive user information, modify administrative records, or potentially bypass authentication mechanisms, leading to severe reputational damage and operational disruption.

Immediate Action: As no official patch is currently available, administrators should restrict access to the administrative directory via network-level controls or disable the vulnerable module until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous patterns in the ID parameter, specifically looking for SQL syntax characters such as single quotes, semicolons, or common SQL keywords.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the specified administrative endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability disclosure.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents an immediate risk to any deployment of the Hostel Management System. Organizations must prioritize restricting access to the affected administrative interface immediately and monitor for any signs of unauthorized database interaction until a vendor-supplied patch can be applied.