An unauthenticated remote SQL injection vulnerability in the kidaze CourseSelectionSystem poses a significant risk to data integrity and system security.

The application is susceptible to SQL injection via the CPU argument in the /Profilers/PriProfile/COUNT3s6.php file. This flaw permits unauthenticated remote attackers to execute arbitrary SQL commands against the backend database.

The ability for an unauthenticated attacker to inject SQL queries can lead to unauthorized data exposure, potential modification of database records, or complete compromise of the underlying application database. With a CVSS score of 7.3, this high severity vulnerability demands immediate attention to prevent unauthorized access to sensitive educational or user data managed by the system.

Immediate Action: Since no specific patch version is disclosed for this rolling release software, administrators should restrict network access to the affected script or implement strict input validation on the CPU parameter.

Proactive Monitoring: Monitor web server access logs for anomalous requests containing SQL syntax or unusual query strings directed at the /Profilers/PriProfile/COUNT3s6.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the identified vulnerable argument.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub issue.

Given the availability of a public proof-of-concept and the ease of exploitation over a network, this vulnerability presents a clear and present danger to affected systems. Organizations must prioritize auditing their deployments of the kidaze CourseSelectionSystem and apply restrictive filtering or temporary disabling of the affected file until a formal security update is provided by the developers.