The code-projects Student File Management System version 1.0 is vulnerable to an unauthenticated SQL injection attack, posing a significant risk to database integrity and confidentiality.

This is a SQL injection vulnerability (CWE-89) located in the /admin/login_query.php script. An unauthenticated attacker can exploit this by injecting malicious SQL commands into the Username parameter to interact directly with the backend database.

Successful exploitation of this vulnerability permits unauthorized interaction with the application database, which may lead to data exfiltration, unauthorized administrative access, or complete compromise of the student record system. Given the CVSS score of 7.3, this represents a high-severity risk that could result in significant reputational damage and a breach of sensitive user information.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/login_query.php endpoint and implement strict input validation on all login fields.

Proactive Monitoring: Monitor server access logs for anomalous SQL syntax or unexpected character sequences originating from the login page, and audit database query logs for unauthorized activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the login authentication flow.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the technical write-up found at the provided GitHub reference.

Due to the lack of an official vendor patch and the availability of a public proof-of-concept, this vulnerability must be treated with high urgency. Organizations utilizing this software should immediately restrict access to the affected login interface or move the application behind a robust WAF to prevent potential exploitation until a permanent security update is provided by the vendor.