The CASAP Automated Enrollment System version 1.0 is susceptible to an unauthenticated SQL injection vulnerability, posing a significant risk of unauthorized database access and manipulation.

The application fails to properly sanitize user input in the update_student.php file, specifically within the fname and student_class parameters. This allows an unauthenticated attacker to execute arbitrary SQL commands against the backend database.

Successful exploitation of this vulnerability could lead to the exposure of sensitive student records, modification of enrollment data, or potential loss of data integrity. With a CVSS score of 7.3, this flaw is categorized as high severity because it enables unauthenticated remote access to core application data, which could result in significant reputational damage and operational disruption.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the update_student.php file or take the application offline until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for anomalous HTTP requests targeting update_student.php, particularly those containing SQL syntax or unusual character encodings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the specified parameters.

Public Exploit Available: Unknown.

Given the high CVSS score and the presence of a proof-of-concept, users of the CASAP Automated Enrollment System must prioritize securing the vulnerable endpoint. If a vendor update is not provided, manual remediation of the source code to implement parameterized queries is strongly recommended to prevent potential data breaches.