The Scholars Tracking System 1.0 contains a critical SQL injection vulnerability allowing unauthenticated attackers to manipulate database records.

The application fails to perform authentication checks and sanitization on POST parameters (firstname, lastname, username, password, user_id) in /admin/save_user.php and /admin/update_user.php, facilitating unauthenticated SQL injection.

This flaw permits an unauthenticated attacker to bypass authentication, modify administrative accounts, or extract sensitive data from the database. With a CVSS score of 9.8, the vulnerability poses a severe risk of total application compromise and unauthorized access to student/user records.

Immediate Action: Since no official patch is available, immediately restrict access to the /admin/ directory via network-level controls or web server authentication.

Proactive Monitoring: Review database query logs for unusual syntax or unauthorized modifications to user tables.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection detection rules to block malicious traffic targeting the vulnerable PHP endpoints.

Public Exploit Available: Unknown

Given the lack of a vendor patch, this software should be considered insecure for production use. If continued use is required, administrators must implement strict network-level isolation and monitor for signs of unauthorized database manipulation.