The itsourcecode Student Management System 1.0 is vulnerable to remote SQL injection, which allows unauthenticated attackers to manipulate database queries.

This is an unauthenticated SQL injection vulnerability located in the newcurriculm.php file. Attackers can execute arbitrary SQL commands by manipulating the ID argument, as the application fails to properly sanitize input before processing database queries.

Successful exploitation of this vulnerability permits unauthorized database interaction, which may lead to the disclosure of sensitive student or administrative information. Given the CVSS score of 7.3, this represents a high risk to data confidentiality and system integrity, potentially leading to unauthorized data modification or administrative account compromise.

Immediate Action: Since a vendor-provided patch is currently unknown, restrict network access to the newcurriculm.php file and implement strict input validation for the ID parameter.

Proactive Monitoring: Monitor web server logs for suspicious URL parameters containing SQL syntax or unusual query patterns targeting the newcurriculm.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads directed at the vulnerable application.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

The presence of a public proof-of-concept significantly lowers the barrier for attackers to exploit this vulnerability. Organizations using this software should immediately restrict access to the affected script and prioritize the implementation of robust input sanitization or transition to a secure alternative until an official patch is released by the vendor.