The Sports Club Management System version 1.0 contains a critical SQL injection vulnerability that permits unauthenticated remote attackers to compromise database integrity.

The flaw exists in the /dashboard/admin/change_s_pwd.php file, where the login_id parameter fails to properly sanitize user input. This allows an unauthenticated attacker to inject malicious SQL commands directly into the backend database.

Successful exploitation of this SQL injection vulnerability can lead to unauthorized data exposure, modification, or deletion of sensitive club management records. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and availability, potentially resulting in total compromise of the application database.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the management dashboard or take the application offline until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous patterns in the login_id parameter, specifically looking for SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection signatures targeting the /dashboard/admin/change_s_pwd.php endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the research write-up at the provided GitHub reference.

Due to the lack of a vendor-supplied patch and the presence of a public proof-of-concept, this vulnerability poses an immediate threat to any exposed instance of the Sports Club Management System. Organizations must prioritize restricting access to the affected interface and implement strict input validation via WAF rules until the developer provides a permanent fix.