The itsourcecode Web-Based Internet Laboratory Management System is vulnerable to a remote SQL injection flaw that could allow unauthenticated attackers to compromise database integrity.

This is a SQL injection vulnerability (CWE-89) located in the /user/controller.php file. The vulnerability is remotely exploitable by an unauthenticated attacker, allowing for the manipulation of backend database queries.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive data stored within the system database. Given the CVSS score of 7.3, this represents a high-severity risk that could facilitate data exfiltration or potential disruption of laboratory management operations.

Immediate Action: Since a formal vendor patch is currently unknown, administrators should restrict access to the /user/controller.php endpoint via network-level controls or by disabling the affected functionality if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous request patterns, particularly those containing SQL syntax or unusual parameters directed at the /user/controller.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the researcher.

Given the availability of a public proof-of-concept and the lack of a clear vendor-provided patch, organizations utilizing this system must prioritize immediate mitigation. Restricting network access to the application and implementing WAF protections is essential to preventing potential unauthorized data access until a permanent security update is released.