An unauthenticated SQL injection vulnerability in itsourcecode Student Management System 1.0 poses a significant risk of unauthorized database manipulation and information disclosure.

This vulnerability is a SQL injection (CWE-89) flaw located in the /update_account.php file. An unauthenticated remote attacker can inject malicious SQL commands via the ID parameter to interact directly with the backend database.

The ability for an unauthenticated user to execute arbitrary SQL commands presents a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to student records, administrative credentials, or sensitive institutional data, potentially resulting in a total compromise of the application database and significant reputational damage. The CVSS score of 7.3 reflects this high risk, particularly given that the attack vector is network-based and requires no prior authentication.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /update_account.php endpoint and implement strict input validation to sanitize all user-supplied data.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected characters targeting the update_account.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block common SQL injection payloads targeting this application path.

Public Exploit Available: Yes, a public proof-of-concept exists as referenced in the GitHub issue reported by the vulnerability researcher.

Given the availability of a public proof-of-concept and the lack of an official vendor patch, this vulnerability must be treated with high priority. Organizations using itsourcecode Student Management System 1.0 should immediately isolate affected systems from public networks or implement robust WAF filtering to prevent exploitation while awaiting a formal fix from the developer.