The itsourcecode Student Management System 1.0 contains a critical SQL injection vulnerability that allows remote, unauthenticated attackers to execute unauthorized database operations.

This is a SQL injection vulnerability (CWE-89) located in the /newsubject.php file. The application fails to properly sanitize the sub argument, enabling an unauthenticated attacker to inject malicious SQL commands remotely.

Successful exploitation of this flaw could lead to unauthorized access to sensitive student data, potential data modification, or complete database compromise. Given the CVSS score of 7.3, this represents a high-severity risk to the confidentiality and integrity of the system. If left unaddressed, the potential for unauthorized data extraction poses significant regulatory and reputational risks to the organization.

Immediate Action: As there is no official patch available, administrators should restrict network access to the /newsubject.php endpoint or disable the affected module entirely until a secure update is released by the vendor.

Proactive Monitoring: Monitor database query logs for suspicious syntax, such as union-based injections or unexpected string concatenation, originating from the web server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns targeting the sub parameter.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the GitHub issue referenced in the vulnerability report.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk. Organizations utilizing this software must implement the recommended compensating controls immediately and monitor for any signs of unauthorized access. Prioritize migrating away from the affected software if the vendor does not provide a security update in a timely manner.