A critical SQL injection vulnerability in itsourcecode Apartment Management System 1.0 allows unauthenticated remote attackers to manipulate database queries.

The application fails to properly sanitize the ID argument within the /unit/addunit.php file, allowing for SQL injection. This flaw is remotely exploitable by an unauthenticated attacker.

The ability to execute arbitrary SQL commands poses a significant threat to data confidentiality, integrity, and availability. With a CVSS score of 7.3, this high severity vulnerability could allow unauthorized parties to access, modify, or delete sensitive apartment management data, potentially leading to total database compromise and system instability.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the affected web directory or disable the vulnerable unit management module until a fix is released.

Proactive Monitoring: Review web server access logs for suspicious patterns, particularly requests containing SQL syntax or unusual parameters targeting /unit/addunit.php.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads before they reach the application layer.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up found at the GitHub issue tracker (https://github.com/zzb1388/cve/issues/39).

Given the availability of a public proof-of-concept, this vulnerability presents a clear and present danger to affected installations. Organizations should prioritize isolating the vulnerable component immediately and restrict network access to the Apartment Management System until the vendor provides a formal security update.