A critical SQL injection vulnerability in the itsourcecode Web-Based Internet Laboratory Management System 1.0 allows unauthenticated remote attackers to compromise the underlying database.

The application is susceptible to SQL injection via the /subject/controller.php file, which fails to properly sanitize user input, allowing an unauthenticated attacker to manipulate backend database queries.

The vulnerability carries a CVSS score of 7.3, indicating a high risk to data integrity and confidentiality. Successful exploitation could allow an attacker to unauthorizedly access, modify, or delete sensitive laboratory management data, potentially leading to significant operational disruption and a breach of institutional data privacy.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected web application and disable the vulnerable functionality if it is not business-critical.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests directed at the /subject/controller.php endpoint, specifically looking for SQL syntax patterns or unexpected character strings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting input parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue tracker.

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability presents an elevated risk to the environment. Organizations currently running version 1.0 of this system should prioritize isolating the application from external networks and implement strict input validation via WAF rules until a secure version is released.