A critical SQL injection vulnerability in the itsourcecode Apartment Management System allows unauthenticated remote attackers to execute arbitrary database queries, posing a significant risk to data integrity.

This is a SQL injection vulnerability (CWE-89) triggered by improper sanitization of the hdnid parameter in the /floor/addfloor.php file. The vulnerability is exploitable by unauthenticated remote attackers.

The ability to perform SQL injection allows an attacker to interact directly with the backend database, potentially leading to unauthorized data exposure, modification, or deletion. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent the compromise of sensitive management data and potential loss of system availability.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the /floor/addfloor.php endpoint or disable the affected functionality until a vendor update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected characters targeting the /floor/addfloor.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting input parameters.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up on GitHub (https://github.com/zzb1388/cve/issues/38).

Given the availability of a public proof-of-concept, the risk of exploitation is elevated. Organizations currently utilizing the itsourcecode Apartment Management System must treat this vulnerability with high urgency. Implement the suggested WAF filtering and access restrictions immediately to protect the database environment while awaiting a formal remediation from the vendor.