A critical SQL injection vulnerability in the Student File Management System 1.0 allows unauthenticated remote attackers to manipulate database queries, posing a significant risk of unauthorized data access.

The application is susceptible to SQL injection through the stud_no argument in the login_query.php file. This flaw is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS attack vector.

Successful exploitation of this vulnerability could lead to the unauthorized disclosure or manipulation of sensitive student data stored within the backend database. Given the CVSS score of 7.3, this represents a high-severity risk that could result in significant reputational damage, loss of data integrity, and potential non-compliance with data privacy regulations.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the application or take the system offline until a secure version is released.

Proactive Monitoring: Review application and database logs for anomalous input patterns, particularly unusual characters or SQL syntax in the stud_no parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the login_query.php endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability report.

The presence of a public proof-of-concept elevates the urgency of this advisory. Organizations currently running the Student File Management System 1.0 must prioritize the implementation of compensating controls or network isolation to prevent unauthorized database access. Monitor vendor channels closely for the release of a security update and apply it immediately upon availability.