A critical SQL injection vulnerability in the itsourcecode Web-Based Internet Laboratory Management System allows unauthenticated remote attackers to compromise database integrity.

The application is susceptible to SQL injection (CWE-89) within the /course/controller.php file. This flaw allows an unauthenticated, remote attacker to manipulate database queries by injecting malicious SQL commands.

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a significant risk to data confidentiality, integrity, and availability. Successful exploitation could lead to unauthorized access to sensitive laboratory data, potential modification of system records, or total database compromise. Given the CVSS score of 7.3, this represents a high-severity risk that requires immediate attention to prevent unauthorized data exfiltration.

Immediate Action: As there is no official patch available, administrators should immediately restrict network access to the application or take the system offline until a fix is provided by the vendor.

Proactive Monitoring: Review web server access logs for suspicious patterns, specifically looking for unusual characters or SQL syntax within URL parameters targeting the /course/controller.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to mitigate the risk while the vulnerability remains unpatched.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the technical write-up provided by the researcher at GitHub.

This vulnerability presents a high risk due to the lack of required authentication and the presence of a public proof-of-concept. Organizations utilizing the itsourcecode Web-Based Internet Laboratory Management System must treat this as a high-priority incident. Until the vendor releases a security update, isolation of the affected system is the most effective method to prevent potential exploitation.