A critical SQL injection vulnerability in the kidaze CourseSelectionSystem allows unauthenticated remote attackers to manipulate database queries.

This flaw is a SQL injection vulnerability (CWE-89) triggered by improper sanitization of the cbranch parameter within the /Profilers/PriProfile/COUNT3s4.php file. The vulnerability is remotely exploitable without authentication, as confirmed by the CVSS attack vector (AV:N/AC:L/PR:N/UI:N).

Successful exploitation of this vulnerability could lead to unauthorized data exposure, modification, or deletion within the underlying database. Given the CVSS score of 7.3, this represents a high-severity risk that could compromise the integrity and confidentiality of the course management system, potentially leading to unauthorized administrative actions or data breaches.

Immediate Action: Since no specific patch version is available due to the continuous delivery model, users should audit the source code in /Profilers/PriProfile/COUNT3s4.php and apply input validation to the cbranch argument, or contact the vendor for the latest secure commit hash.

Proactive Monitoring: Monitor web server access logs for anomalous requests to the identified PHP file, particularly those containing SQL syntax or unusual query patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules designed to detect and block SQL injection attempts targeting query parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub issue.

Given the availability of a public proof-of-concept, the risk of exploitation is elevated. Administrators must treat this vulnerability with urgency by implementing input sanitization or restricting access to the affected endpoint until a vendor-provided update is confirmed.