The itsourcecode Apartment Management System version 1.0 contains a critical SQL injection vulnerability that allows remote, unauthenticated attackers to execute arbitrary database queries.

This vulnerability is a SQL injection (CWE-89) located in the /management/add_m_committee.php file, triggered by improper neutralization of the ID argument. The attack vector is network-based and does not require user authentication.

Successful exploitation of this flaw allows an attacker to interact directly with the backend database, potentially leading to unauthorized data exposure or modification. With a CVSS score of 7.3, this high-severity vulnerability poses a significant risk to the confidentiality and integrity of management system data, which could lead to broader administrative compromise of the platform.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /management/ directory to authorized internal networks only or disable the affected functionality entirely.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous requests containing SQL syntax patterns targeted at the add_m_committee.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection payloads targeting the ID parameter.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability presents an immediate risk. Organizations utilizing the Apartment Management System must implement strict network-level access controls or WAF filtering immediately to mitigate the risk until an official vendor update is released.