An unauthenticated SQL injection vulnerability in itsourcecode Student Transcript Processing System version 1.0 poses a significant risk of unauthorized database interaction.

This vulnerability consists of a SQL injection flaw (CWE-89) within the login.php file, where the uname parameter fails to properly sanitize user input. The attack is remotely exploitable by an unauthenticated user to interact with the backend database.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive student data, potential data exfiltration, or modification of academic records. With a CVSS score of 7.3, this high-severity flaw represents a notable risk to data confidentiality and system integrity, potentially resulting in regulatory non-compliance or loss of institutional trust.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the application or take the service offline until a secure version is released by the vendor.

Proactive Monitoring: Review web server and database logs for suspicious SQL syntax, such as UNION statements or tautologies, originating from the login.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the uname parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability report.

Given the high CVSS score and the presence of a public proof-of-concept, this vulnerability warrants immediate attention. Organizations using the Student Transcript Processing System should prioritize isolating the affected component from external networks, as the lack of an available vendor patch makes proactive monitoring and compensating controls the only viable methods for reducing exposure until a permanent fix is provided.