The Scholars Tracking System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise database integrity and confidentiality.

The application fails to sanitize the post_content parameter in the /sts/home.php file before including it in SQL queries. This flaw allows an unauthenticated attacker to inject malicious SQL statements, facilitating unauthorized database manipulation and potential data exfiltration.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive institutional data, potential modification or deletion of records, and total compromise of the database layer. With a CVSS score of 7.3, this represents a high-severity risk that could lead to significant operational disruption and loss of trust, particularly given that the attack vector requires no authentication.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the /sts/home.php endpoint or disable the affected functionality until a secure version is released.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically looking for SQL syntax characters or sleep commands originating from the post_content parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block POST requests containing suspicious SQL injection payloads targeting the /sts/home.php file.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher's GitHub write-up.

The presence of a public proof-of-concept significantly increases the risk of exploitation by automated scanners and malicious actors. Organizations currently utilizing Scholars Tracking System 1.0 must prioritize implementing the aforementioned compensating controls immediately to prevent unauthorized database access, as a vendor-supplied patch is currently unavailable.