The itsourcecode Apartment Management System 1.0 is vulnerable to a remote SQL injection attack that allows unauthenticated adversaries to manipulate database queries.

This is a SQL injection vulnerability (CWE-89) triggered by improper sanitization of the ID argument within the /fund/add_fund.php file. The vulnerability is remotely exploitable without requiring authentication (AV:N/AC:L/PR:N/UI:N).

The ability for an unauthenticated attacker to inject malicious SQL commands poses a significant risk to data confidentiality and integrity. With a CVSS score of 7.3, this high-severity flaw could allow unauthorized actors to extract sensitive information, modify system records, or potentially disrupt the availability of the Apartment Management System, leading to operational downtime and loss of trust.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /fund/add_fund.php endpoint or disable the affected module until the vendor releases a security update.

Proactive Monitoring: Review web server and application logs for suspicious HTTP requests containing SQL syntax, particularly directed toward the /fund/add_fund.php file.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to detect and block malicious SQL injection patterns targeting the identified vulnerable parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Given the public availability of exploit code and the lack of a vendor-supplied patch, this vulnerability presents a credible risk to the integrity of the Apartment Management System. Organizations currently running version 1.0 should prioritize implementing network-level blocks or WAF protections immediately to mitigate the threat of remote database exploitation.