The CASAP Automated Enrollment System version 1.0 is susceptible to an unauthenticated SQL injection vulnerability, posing a significant risk of unauthorized database access and manipulation.

The application is vulnerable to SQL injection within the update_password.php file via the new_password parameter. This flaw allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database.

Successful exploitation allows an attacker to interact directly with the application database, potentially leading to the theft of sensitive user credentials, enrollment records, or system configuration data. Given the CVSS score of 7.3, this high-severity vulnerability represents a significant risk to data confidentiality and integrity, which could result in severe reputational damage and the compromise of institutional data.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the update_password.php endpoint or take the application offline until the vendor releases a security update.

Proactive Monitoring: Security teams should monitor database logs for anomalous query patterns, such as unexpected syntax characters or signs of unauthorized administrative activity originating from the enrollment system.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the new_password parameter.

Public Exploit Available: Unknown.

Due to the unauthenticated nature of this vulnerability and the existence of a proof-of-concept, the risk to the organization is elevated. System administrators must prioritize isolating the affected application from public network access and implement strict input validation or WAF filtering to prevent potential exploitation while awaiting a vendor-supplied patch.