A critical SQL injection vulnerability in the itsourcecode Apartment Management System 1.0 allows unauthenticated remote attackers to compromise the backend database.

This vulnerability is a SQL injection flaw located within the rsid argument of the /report/rented_info.php file. The vulnerability is exploitable by unauthenticated remote attackers, as no authentication is required to interact with the affected endpoint.

The ability for an unauthenticated attacker to inject malicious SQL commands poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive tenant records, administrative credentials, or full database exfiltration. Given the CVSS score of 7.3, this flaw represents a high-risk entry point for attackers to gain a foothold within the application environment.

Immediate Action: As no official patch is currently available, users should restrict access to the /report/rented_info.php file or disable the affected module entirely until a vendor update is released.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests containing SQL syntax patterns targeting the rsid parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block incoming requests that contain SQL injection sequences targeting the identified vulnerable endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Due to the lack of an official vendor patch and the presence of a public proof-of-concept, this vulnerability must be treated as a high priority. Administrators are urged to implement network-level access controls or WAF protections immediately to prevent unauthorized database access. Monitor the vendor website for official security updates and apply them as soon as they become available to permanently remediate this SQL injection risk.