An unauthenticated SQL injection vulnerability in the itsourcecode Student Management System allows remote attackers to compromise database integrity and access sensitive information.

The application fails to properly sanitize user input provided to the sy parameter in the list_report.php file. This flaw allows an unauthenticated attacker to execute arbitrary SQL commands, enabling unauthorized database interactions.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive student data, potential data tampering, and complete loss of database confidentiality and integrity. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant reputational damage and non-compliance with data protection regulations.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the list_report.php file or the entire application via network-level controls until a secure version is released.

Proactive Monitoring: Review web server and database logs for anomalous activity, specifically looking for SQL syntax patterns or time-based blind injection indicators such as sleep commands within the sy parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting POST parameters.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the researcher's GitHub repository.

The presence of a public proof-of-concept elevates the risk of this vulnerability significantly. Organizations utilizing the itsourcecode Student Management System 1.0 must prioritize the implementation of compensating controls, such as WAF rules or strict network segmentation, to mitigate the risk of unauthorized database access while awaiting a formal vendor security update.