A critical SQL injection vulnerability in the itsourcecode Apartment Management System 1.0 allows for unauthenticated remote exploitation, posing a significant risk to database integrity.

This vulnerability is a SQL injection flaw (CWE-89) located in the /maintenance/add_maintenance_cost.php file. An unauthenticated attacker can manipulate the ID argument to execute unauthorized database queries.

The ability to perform unauthenticated SQL injection represents a high risk of unauthorized data access, modification, or potential administrative compromise of the underlying database. With a CVSS score of 7.3, this vulnerability indicates a significant threat to the confidentiality and integrity of management system data. Organizations relying on this software face potential service disruption and exposure of sensitive apartment management records.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the affected script or disable the Apartment Management System until a secure update is provided by the vendor.

Proactive Monitoring: Review web server and database logs for suspicious query patterns, particularly those involving the /maintenance/add_maintenance_cost.php endpoint or unexpected SQL syntax characters.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection filtering rules to block malicious requests targeting the vulnerable ID parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability must be treated as a high-priority risk. Administrators should isolate the vulnerable application from external networks immediately to prevent unauthorized access. Prioritize the replacement of this system if the vendor does not provide a remediation path in the near term.