A critical SQL injection vulnerability in itsourcecode Sports Management System 1.0 allows unauthenticated attackers to execute arbitrary database queries, posing a high risk to data integrity.

The application suffers from a SQL injection flaw in the /Admin/sports.php file, where the code parameter is not properly sanitized. This allows an unauthenticated remote attacker to inject malicious SQL commands into the backend database.

The ability to perform SQL injection without authentication represents a significant security risk, potentially leading to unauthorized data exposure, modification, or deletion within the database. Given the CVSS score of 7.3, this flaw is classified as High severity and could result in severe reputational damage and loss of sensitive administrative information.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /Admin/sports.php endpoint or disable the affected module until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for anomalous request patterns targeting the /Admin/sports.php file, specifically looking for SQL syntax characters like single quotes or comment markers in the code parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to filter and block malicious SQL injection payloads targeting the application's input parameters.

Public Exploit Available: Yes, a public proof-of-concept exists via the technical write-up referenced at https://github.com/kangsf1989/2025/issues/1.

Given the availability of a public proof-of-concept and the unauthenticated nature of this vulnerability, organizations must treat this as a priority. Administrators should apply compensating controls immediately, such as WAF rules or network segmentation, and monitor the vendor for the release of a security patch to fully remediate the underlying code flaw.