The itsourcecode Student Management System 1.0 contains a critical SQL injection vulnerability that permits unauthenticated remote attackers to compromise database integrity and access sensitive data.

This is a SQL injection vulnerability (CWE-89) located in the statistical.php file. The application fails to sanitize the id parameter during GET requests, allowing an unauthenticated attacker to manipulate backend database queries.

A successful exploit allows unauthorized access to the underlying database, potentially leading to sensitive data leakage, unauthorized data modification, or complete system compromise. With a CVSS score of 7.3, this vulnerability represents a high risk to business continuity and data confidentiality, as it requires no user interaction or authentication to trigger.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the statistical.php endpoint or disable the affected functionality entirely.

Proactive Monitoring: Security teams should review web server access logs for anomalous GET requests containing SQL syntax or unusual characters in the id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, specifically targeting the id parameter in incoming traffic.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the referenced GitHub issue.

Given the availability of public proof-of-concept code and the ease of exploitation, this vulnerability poses a significant risk to any exposed installation. Administrators are urged to implement strict input validation or network-level access controls immediately until a vendor-supplied security update is released and applied.