The itsourcecode Student Management System 1.0 is vulnerable to unauthenticated SQL injection, which could allow remote attackers to compromise the underlying database.

This is a SQL injection vulnerability (CWE-89) located in the form137.php file. An unauthenticated attacker can manipulate the id parameter to inject malicious SQL commands, as the application fails to properly sanitize user input before processing it in database queries.

Successful exploitation of this vulnerability allows unauthorized access to the application database, which may result in sensitive data leakage, data tampering, or total system compromise. Given the CVSS score of 7.3, this represents a high-severity risk to business continuity and data integrity, especially as the vulnerability can be triggered remotely without requiring any user credentials.

Immediate Action: As no official patch is currently available, administrators should immediately restrict network access to the Student Management System or disable the vulnerable form137.php file if it is not business-critical.

Proactive Monitoring: Security teams should monitor web server logs for suspicious GET requests targeting form137.php, specifically looking for SQL-related keywords or time-based delay patterns often associated with automated scanning tools.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns and sanitize inputs directed at the id parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

The presence of a publicly available proof-of-concept elevates the risk of exploitation for this high-severity vulnerability. Because the vendor has not provided a patch, it is imperative to implement strict network-level access controls or WAF filtering to prevent unauthorized interaction with the vulnerable endpoint. Prioritize the replacement or retirement of this legacy software if security updates cannot be applied.