A critical SQL injection vulnerability in the itsourcecode Society Management System 1.0 allows unauthenticated attackers to compromise database integrity and gain unauthorized data access.

This is a SQL injection vulnerability (CWE-89) located in the /admin/edit_admin_query.php file. The application fails to properly sanitize the username parameter before including it in a database query, allowing an unauthenticated attacker to manipulate SQL commands remotely.

Successful exploitation allows an attacker to bypass authentication, extract sensitive information, modify or delete database records, and potentially gain full control over the application backend. With a CVSS score of 7.3, this represents a high-severity risk that could lead to significant data breaches, loss of customer trust, and operational disruption.

Immediate Action: As no official patch is available from the vendor, users should restrict access to the /admin/ directory using network-level controls or disable the application entirely until a secure version is released.

Proactive Monitoring: Security teams should review web server access logs for anomalous POST requests to /admin/edit_admin_query.php containing SQL-related characters like single quotes, dashes, or SQL keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the username parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the referenced GitHub security issue.

Given the availability of a public exploit and the lack of an official vendor patch, this vulnerability poses a clear and present danger to any organization running the Society Management System. Administrators are urged to isolate the affected instance from the public internet immediately and implement strict input validation or WAF-based filtering to mitigate the risk of unauthorized database manipulation.