A critical SQL injection vulnerability in the kidaze CourseSelectionSystem allows unauthenticated remote attackers to compromise database integrity.

This is a SQL injection vulnerability (CWE-89) located in the /Profilers/SProfile/reg.php file, triggered by manipulating the USN parameter. The attack is fully unauthenticated, requiring no prior user privileges or interaction to execute.

Successful exploitation allows an attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion within the underlying database. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to the confidentiality and integrity of student records and system information.

Immediate Action: Since no official patch is available, restrict access to the /Profilers/SProfile/reg.php endpoint via network controls or disable the vulnerable module until a vendor fix is released.

Proactive Monitoring: Review web server access logs for unusual patterns or suspicious characters in the USN parameter, and monitor database query logs for unauthorized or unexpected SQL syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the technical write-up provided in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability presents an immediate risk. Organizations utilizing CourseSelectionSystem must implement strict network-level access controls or WAF filtering to prevent exploitation until the vendor addresses the underlying code flaw.