The itsourcecode Student Management System version 1.0 is vulnerable to an unauthenticated SQL injection attack, which could lead to full database compromise.

This is a SQL injection vulnerability (CWE-89) located in the /student_p.php file. An unauthenticated attacker can exploit this flaw by injecting malicious SQL queries into the id parameter (GET request) to manipulate database operations.

Successful exploitation allows an attacker to bypass authentication mechanisms, potentially leading to unauthorized data access, sensitive information leakage, data tampering, or total system compromise. Given the CVSS score of 7.3, this represents a significant security risk, as the application fails to properly sanitize user input, thereby exposing the backend database to external manipulation.

Immediate Action: As there is no vendor-provided patch, administrators should immediately restrict access to the affected /student_p.php endpoint or disable the application entirely until a secure version is released. If the application is mission-critical, implement strict input validation and transition to prepared statements with parameterized queries within the source code to neutralize the injection vector.

Proactive Monitoring: Review web server and database logs for anomalous GET requests targeting /student_p.php, specifically looking for payloads containing SQL keywords like UNION, SELECT, or SLEEP. Monitor for unusual database query latency which may indicate blind SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection patterns in URL parameters. Ensure the database service account is configured with the absolute minimum privileges required for operation, preventing the attacker from performing administrative tasks even if the injection is successful.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked GitHub repository research write-up.

This vulnerability presents a high risk due to the lack of required authentication for exploitation and the existence of a public proof-of-concept. Organizations utilizing the itsourcecode Student Management System must prioritize the implementation of compensating controls, such as WAF rules, and seek to replace or update the vulnerable software components as soon as a secure version becomes available.