The Web-Based Internet Laboratory Management System 1.0 is vulnerable to unauthenticated SQL injection, posing a significant risk of unauthorized database interaction and potential data compromise.

This vulnerability involves an SQL injection flaw within the file /enrollment/controller.php, which can be triggered remotely by an unauthenticated attacker to manipulate backend database operations.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL commands against the underlying database. With a CVSS score of 7.3, this high-severity flaw could lead to unauthorized access to sensitive student or laboratory data, potential data destruction, or complete compromise of the system integrity, resulting in significant operational downtime and reputational damage.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the laboratory management system or disable the affected enrollment functionality until a vendor update is released.

Proactive Monitoring: Security teams should monitor web server logs for suspicious URL parameters containing SQL syntax, such as UNION, SELECT, or OR 1=1, directed at the /enrollment/controller.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules configured to detect and block SQL injection patterns to provide virtual patching until a permanent fix is provided by the vendor.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the researcher at https://github.com/f14g-orz/CVE/issues/4.

Given the availability of a public proof-of-concept and the unauthenticated nature of the attack, this vulnerability represents a high risk to the availability and confidentiality of the affected management system. Organizations currently running version 1.0 must prioritize the implementation of compensating controls, such as WAF filtering, and actively monitor for unauthorized access attempts until a formal patch is made available by itsourcecode.