A critical SQL injection vulnerability in code-projects Student File Management System 1.0 allows unauthenticated remote attackers to compromise the application database.

This vulnerability is a SQL injection flaw (CWE-89) located in the /admin/save_user.php file. The application fails to properly sanitize the firstname argument, allowing an unauthenticated remote attacker to execute malicious SQL queries against the underlying database.

The ability to perform unauthenticated SQL injection poses a significant risk to data confidentiality, integrity, and availability. An attacker could potentially extract sensitive student data, modify administrative records, or bypass authentication mechanisms. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent unauthorized access and potential system compromise.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory to trusted internal IP addresses only. If the functionality is not business-critical, disable the student file management system until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous HTTP requests targeting /admin/save_user.php, specifically looking for SQL syntax patterns or unexpected character strings in the firstname parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads in incoming traffic.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the security researcher write-up at https://github.com/jjjjj-zr/jjjjjzr5/issues/1.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents an immediate threat to the confidentiality of stored records. Organizations running version 1.0 must prioritize the implementation of compensating controls, such as WAF filtering or network-level access restrictions, until the vendor provides a remediation patch.