The CodeAstro Student Grading System 1.0 contains a critical SQL injection vulnerability that permits unauthenticated remote attackers to compromise database integrity.

This vulnerability is a SQL injection flaw (CWE-89) triggered via the staffId parameter within the adminLogin.php script. The vulnerability is exploitable by unauthenticated remote attackers, allowing for direct interaction with the backend database.

Successful exploitation of this vulnerability allows unauthorized access to or manipulation of sensitive grading and student data. Given the CVSS score of 7.3, this high-severity flaw poses a significant risk to data confidentiality and integrity, potentially leading to unauthorized administrative access or database corruption.

Immediate Action: As no official patch is currently available, administrators should restrict access to the application by placing it behind a VPN or IP whitelist. If possible, disable the affected adminLogin.php functionality until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for anomalous HTTP requests targeting adminLogin.php, specifically searching for SQL syntax or unusual characters in the staffId parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the login endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up at https://github.com/Clw309/CVE/issues/2.

The presence of a public proof-of-concept combined with the unauthenticated nature of this SQL injection necessitates immediate defensive action. Organizations utilizing CodeAstro Student Grading System 1.0 must prioritize restricting network access to the application and implementing strict WAF filtering to mitigate the risk of exploitation while awaiting a permanent vendor patch.