An unauthenticated SQL injection vulnerability in code-projects Prison Management System 2.0 poses a critical risk of unauthorized database access and potential system compromise.

The application fails to sanitize the keyname parameter within the /admin/search1.php file before concatenating it into a database query. This flaw allows an unauthenticated remote attacker to perform SQL injection attacks against the underlying database.

Successful exploitation allows an attacker to bypass authentication, extract sensitive data from the database, or potentially gain further control over the system. Given the CVSS score of 7.3, this represents a significant security risk that could lead to full loss of confidentiality and integrity for the data managed by the application.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory and implement strict input validation for all user-supplied data.

Proactive Monitoring: Review web server and database access logs for suspicious query patterns, such as unexpected SQL keywords or high volumes of requests to search1.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the keyname parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced security researcher report.

The presence of a functional proof-of-concept significantly increases the risk of exploitation. Organizations utilizing this software must prioritize the implementation of compensating controls, such as WAF rules or network segmentation, until an official vendor update is released and applied to remediate this critical injection flaw.