A critical SQL injection vulnerability in the itsourcecode Student Management System 1.0 allows unauthenticated remote attackers to compromise the underlying database.

This is a SQL injection vulnerability (CWE-89) located in the candidates_report.php file. The application fails to properly sanitize the school_year GET parameter, allowing an unauthenticated attacker to manipulate backend database queries.

Successful exploitation allows an attacker to perform unauthorized database operations, including data exfiltration, modification, or potential full system compromise. With a CVSS score of 7.3, this flaw poses a significant risk to data confidentiality and integrity, as it does not require any prior user authentication or administrative privileges to trigger.

Immediate Action: Since a formal vendor patch is currently unavailable, administrators must restrict access to the /candidates_report.php file via network controls or web server configurations until a fix is provided.

Proactive Monitoring: Review web server access logs for anomalous GET requests targeting /candidates_report.php, particularly those containing SQL syntax such as UNION, SELECT, or SLEEP commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in the school_year query parameter.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research write-up hosted on GitHub.

Given the availability of public proof-of-concept code and the lack of authentication required for exploitation, this vulnerability presents a high risk. Organizations utilizing this software should immediately restrict external access to the vulnerable endpoint and prioritize implementing strict input validation or migrating to a secure alternative.