A critical SQL injection vulnerability in the code-projects Student File Management System 1.0 permits unauthenticated remote attackers to compromise database integrity.

The application is vulnerable to SQL injection (CWE-89) via the stud_id parameter in the /admin/delete_student.php file, which can be triggered by an unauthenticated remote attacker.

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to student records, modification of administrative data, or complete database compromise. With a CVSS score of 7.3, this flaw is categorized as high severity and requires immediate attention to prevent potential data breaches.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory and evaluate the necessity of the Student File Management System until a secure version is released.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests containing SQL syntax patterns targeting the delete_student.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads directed at the vulnerable endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists via the GitHub issue referenced in the vulnerability report.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a significant risk to the affected environment. Organizations currently running version 1.0 of the Student File Management System should isolate the application from the public internet immediately and monitor for unauthorized database activity until a vendor-supplied patch is deployed.