A critical SQL injection vulnerability in the itsourcecode Apartment Management System 1.0 poses a severe risk of database compromise to unauthenticated remote attackers.

The application is susceptible to SQL injection (CWE-89) because it fails to properly sanitize the ID parameter within the /complain/addcomplain.php script, allowing unauthenticated attackers to manipulate database queries remotely.

The exploitation of this vulnerability could lead to unauthorized data extraction, modification, or potential administrative bypass of the management system. Given the CVSS score of 7.3, this represents a high-severity threat that could result in significant data breaches and a loss of system integrity for organizations relying on this software.

Immediate Action: As no official patch is currently available, administrators should immediately restrict network access to the /complain/addcomplain.php endpoint or disable the affected module until a vendor-supplied update is released.

Proactive Monitoring: Security teams should monitor web server logs for suspicious URL patterns containing SQL syntax or unusual requests directed at the addcomplain.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting input parameters.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

This SQL injection flaw presents a clear path for unauthorized database interaction. Organizations currently using version 1.0 of the Apartment Management System must prioritize restricting public access to the vulnerable script immediately, as the public availability of exploit material increases the likelihood of opportunistic attacks. Monitor the vendor website for future security updates and apply them as soon as they are made available.