A critical SQL injection vulnerability in itsourcecode Human Resource Management System 1.0 poses a severe risk of unauthorized database manipulation by unauthenticated remote attackers.

The application is susceptible to SQL injection via the noticeDesc parameter within the /src/store/NoticeStore.php file. This flaw allows an unauthenticated remote attacker to execute arbitrary SQL commands, potentially leading to unauthorized data access or modification.

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk that could lead to significant data compromise or loss of database integrity. Successful exploitation allows attackers to bypass application logic and interact directly with the backend database, which may result in unauthorized exposure of sensitive HR information or administrative data.

Immediate Action: Since no official patch is currently available, users should restrict network access to the application and monitor for suspicious traffic targeting the /src/store/NoticeStore.php endpoint.

Proactive Monitoring: Security teams should review web server access logs for anomalous SQL syntax or unexpected character patterns in the noticeDesc parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to inspect and block malicious SQL injection payloads directed at the vulnerable endpoint.

Public Exploit Available: Yes, a published proof of concept exists as documented in the research writeup hosted at https://github.com/f14g-orz/CVE/issues/9.

Given the availability of a public proof of concept and the lack of an official patch, administrators should prioritize isolating the affected system from public networks immediately. Organizations must implement strict input validation at the WAF level and prepare for a transition to a secure version of the software as soon as the vendor provides a remediation.