The itsourcecode Student Management System 1.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to compromise database integrity and confidentiality.

The application fails to properly sanitize user input provided via the id parameter in the /uprec.php file. This allows an unauthenticated attacker to inject malicious SQL commands directly into the backend database.

Successful exploitation of this SQL injection flaw grants an attacker the ability to perform unauthorized database operations, including data exfiltration, modification, or deletion. Given the nature of a Student Management System, this could result in the exposure of sensitive student records and credentials, severe reputational damage, and potential violation of data privacy regulations. While the CVSS score of 7.3 reflects a high severity, the lack of required authentication makes this an immediate priority for remediation.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the /uprec.php endpoint or disable the affected module entirely if it is not business critical.

Proactive Monitoring: Review web server and database logs for anomalous POST requests to /uprec.php, specifically searching for SQL syntax patterns like SLEEP, UNION, or OR 1=1.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to filter and block malicious SQL injection payloads targeting the id parameter.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the security researcher's write-up on GitHub.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to any exposed installation of the Student Management System. Administrators must treat this as a high-priority item by implementing WAF filtering or network-level access controls immediately until a secure version or official patch is released by the vendor.