A critical SQL injection vulnerability in the itsourcecode Apartment Management System 1.0 exposes the application to remote data manipulation and unauthorized database access.

The application is susceptible to SQL injection through the fid argument within the /report/fair_info_all.php file. This vulnerability is remotely exploitable by an unauthenticated attacker, allowing for direct interaction with the backend database.

The ability for an unauthenticated attacker to perform SQL injection poses a significant risk to data integrity and confidentiality. Successful exploitation could lead to the unauthorized disclosure of sensitive records, modification of application data, or potential loss of administrative control over the management system. Given the CVSS score of 7.3, this flaw is categorized as high severity and requires immediate attention to prevent data compromise.

Immediate Action: Since no official vendor patch is currently available, users should restrict network access to the /report/fair_info_all.php endpoint or disable the affected module entirely if it is not business critical.

Proactive Monitoring: Security teams should monitor web server logs for anomalous HTTP requests containing SQL syntax patterns or unexpected characters within the fid parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the identified parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

The presence of a public proof-of-concept elevates the risk of exploitation for this high-severity vulnerability. Administrators must prioritize isolating the vulnerable component and implementing strict input validation or WAF-based filtering immediately, as the lack of an official patch leaves the system exposed to potential compromise.