The itsourcecode Online File Management System version 1.0 is vulnerable to an unauthenticated SQL injection attack, which could allow remote actors to compromise database integrity.

This is a SQL injection vulnerability (CWE-89) located in the ajax.php file, triggered by manipulating the Username argument during the login process. The flaw allows an unauthenticated, remote attacker to perform unauthorized database operations.

Successful exploitation of this vulnerability permits unauthorized interaction with the underlying database, potentially leading to data exfiltration, modification, or account bypass. With a CVSS score of 7.3, this represents a high-severity risk that could facilitate full compromise of the application data layer if left unaddressed.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the login interface and disable the affected file if it is not business-critical.

Proactive Monitoring: Review web server access logs for suspicious patterns in the ajax.php request parameters, specifically focusing on SQL syntax characters like single quotes, dashes, or UNION statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming requests to ajax.php that contain SQL injection signatures in the Username parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as attributed to the GitHub issue report referenced by the vulnerability record.

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability poses an immediate risk to the confidentiality and integrity of the system. Organizations should prioritize isolating the affected application or implementing strict WAF filtering until an official security update is released by the vendor.