A critical SQL injection vulnerability in the itsourcecode Apartment Management System 1.0 allows for remote, unauthenticated database manipulation.

This is a SQL injection (CWE-89) vulnerability residing in the /owner_utility/add_owner_utility.php file. Attackers can perform unauthorized database queries by manipulating the ID argument without requiring authentication.

The vulnerability carries a CVSS score of 7.3, indicating a high level of risk to data confidentiality and integrity. Successful exploitation could allow an attacker to dump sensitive tenant or property data, modify administrative records, or potentially gain further access to the underlying server environment.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected script at the network or web server level or disable the vulnerable module entirely.

Proactive Monitoring: Monitor web application logs for suspicious HTTP requests targeting the /owner_utility/ directory, specifically looking for SQL syntax patterns or anomalies in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the identified vulnerable endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up at https://github.com/zhuyi-hz/cve/issues/11.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability poses a significant risk to any deployment of the Apartment Management System 1.0. Organizations should immediately isolate the affected application from the internet or apply strict WAF filtering to prevent exploitation until the vendor releases a secure update.