An unauthenticated SQL injection vulnerability in the kidaze CourseSelectionSystem poses a significant risk to data integrity and unauthorized database access.

This is a SQL Injection vulnerability (CWE-89) located in the login1.php file. The application fails to properly sanitize the Username parameter, allowing an unauthenticated remote attacker to execute arbitrary SQL commands.

The ability to perform SQL injection allows an attacker to bypass authentication, extract sensitive information from the database, or modify data within the application. Given the CVSS score of 7.3, this high-severity flaw could lead to complete compromise of the application user data. Such an incident risks significant reputational damage and potential regulatory non-compliance regarding data protection.

Immediate Action: Since a specific patch version is currently unavailable, users should restrict access to the /Profilers/SProfile/login1.php endpoint or disable the affected module until a vendor-supplied fix is released.

Proactive Monitoring: Security teams should monitor web server logs for anomalous patterns in the Username field, such as SQL syntax characters or unexpected query structures.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection payloads targeted at login parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue (https://github.com/Anti1i/cve/issues/1).

The presence of a public proof-of-concept and the lack of authentication requirements make this vulnerability a high priority for remediation. Administrators must treat this as an urgent risk and implement WAF-based filtering or access restrictions immediately to prevent unauthorized database interaction while awaiting an official software update.