An unauthenticated SQL injection vulnerability in Student Crud Operation 3.3 enables remote attackers to perform unauthorized mass deletion of database records.

This is a critical SQL injection vulnerability (CWE-89) located in the delete.php script. An unauthenticated attacker can supply a malicious payload via the id GET parameter, which is concatenated directly into a database query without sanitization or parameterization.

Successful exploitation of this flaw allows an unauthenticated attacker to execute arbitrary SQL commands, resulting in the potential for mass deletion of records within the card_activation table. While the CVSS score is 7.3, the absence of any authentication requirements and the destructive nature of the vulnerability represent a significant risk to data integrity and business continuity.

Immediate Action: Since an official patch is currently unavailable, users should manually modify the delete.php file to implement prepared statements and enforce strict input validation for the id parameter.

Proactive Monitoring: Review database access logs for anomalous DELETE queries or unusual patterns in GET requests directed at delete.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection patterns, specifically targeting the id parameter in URI strings.

Public Exploit Available: Yes — a published proof-of-concept exists as detailed in the security researcher's write-up.

Given the ease of exploitation and the destructive potential of this vulnerability, administrators should prioritize securing the delete.php endpoint immediately. If the application cannot be patched or protected via a WAF, it should be taken offline or restricted to authorized network segments until a secure update is applied.