A critical SQL injection vulnerability in the itsourcecode Apartment Management System allows unauthenticated remote attackers to manipulate database queries and potentially compromise system data.

This is a SQL injection vulnerability (CWE-89) triggered by improper sanitization of the ID argument within the /bill/add_bill.php file. The vulnerability is exploitable by unauthenticated remote attackers.

Successful exploitation allows an attacker to inject arbitrary SQL commands, which may result in unauthorized access to sensitive data, modification of database records, or denial of service. With a CVSS score of 7.3, this flaw poses a significant risk to the confidentiality and integrity of information stored within the management system.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected installation and disable the vulnerable /bill/add_bill.php endpoint if it is not business-critical.

Proactive Monitoring: Monitor web server access logs for anomalous requests containing SQL syntax patterns or unexpected characters targeting the /bill/add_bill.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection payloads targeting the identified URL parameter.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research write-up at https://github.com/zhuyi-hz/cve/issues/15.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a serious security risk. Organizations currently running this software should prioritize isolating the application from external networks and implement strict input validation controls until a vendor-supplied update is available.