An unauthenticated SQL injection vulnerability in the itsourcecode Student Management System 1.0 poses a critical risk of database compromise and unauthorized data access.

This is a SQL injection vulnerability (CWE-89) located in the /update_subject.php file, where the application fails to sanitize the id parameter. An unauthenticated attacker can supply malicious input to this parameter to execute arbitrary SQL commands against the backend database.

Successful exploitation of this vulnerability allows an attacker to gain unauthorized access to sensitive database information, potentially leading to full data leakage, data tampering, or unauthorized administrative control over the application. With a CVSS score of 7.3, this flaw represents a significant security risk that could lead to complete service disruption and compromise of institutional student records.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /update_subject.php endpoint at the network or web server level.

Proactive Monitoring: Security teams should audit database logs for unusual query patterns, particularly those originating from the /update_subject.php file, and monitor web server logs for suspicious POST requests containing SQL syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the id parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub research repository linked in the vulnerability references.

Given the availability of public proof-of-concept code and the ease of exploitation, this vulnerability must be treated with high urgency. Administrators are advised to implement strict input validation or block access to the vulnerable endpoint until a formal vendor update is released and applied.