An unauthenticated SQL injection vulnerability in the itsourcecode Web-Based Internet Laboratory Management System 1.0 poses a significant risk of unauthorized database interaction.

This is a SQL injection flaw (CWE-89) located within the /settings/controller.php file. The vulnerability allows an unauthenticated, remote attacker to manipulate database queries through the application.

Successful exploitation allows an attacker to inject arbitrary SQL commands into the backend database. This can lead to unauthorized data exposure, modification of database contents, or potential service disruption. With a CVSS score of 7.3, this high-severity vulnerability represents a significant risk to the integrity and confidentiality of the system.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the management system to trusted internal networks only.

Proactive Monitoring: Review web server access logs for suspicious URL parameters containing SQL syntax or unusual characters directed at the /settings/controller.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up on GitHub.

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, users of this software are at elevated risk. Organizations must implement strict network-level access controls to ensure the application is not exposed to the public internet and continue to monitor vendor channels for the release of a security update.