The itsourcecode Society Management System 1.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries and compromise system data.

This vulnerability is a SQL injection flaw located in the /admin/add_admin.php file. An unauthenticated remote attacker can inject malicious SQL commands via the username parameter, bypassing authentication mechanisms to execute unauthorized database operations.

The exploitation of this vulnerability poses a severe risk to data integrity and confidentiality. Successful attacks can lead to unauthorized database access, sensitive data leakage, complete system compromise, and potential service interruption. Given the CVSS score of 7.3, this represents a high-severity risk that could result in significant reputational damage and loss of control over the managed environment.

Immediate Action: As there is no official patch available, administrators should restrict network access to the /admin/ directory or take the application offline until the vendor provides a secure update.

Proactive Monitoring: Review database and web server access logs for anomalous patterns, such as unexpected SQL syntax characters (e.g., single quotes or comment markers) in POST requests to the /admin/add_admin.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting input parameters.

Public Exploit Available: Yes — a published proof-of-concept exists in the researcher's GitHub repository, which includes specific payloads for SQL injection.

Due to the lack of an official patch and the availability of public proof-of-concept code, this vulnerability presents an immediate risk to the affected system. Organizations should prioritize isolating the vulnerable application from external networks and implementing strict input validation or WAF rules to prevent exploitation until a verified fix is released by the vendor.