A critical SQL injection vulnerability exists in the itsourcecode Sports Management System version 1.0 that allows unauthenticated remote attackers to compromise the underlying database.

This is a classic SQL injection vulnerability (CWE-89) located in the /login.php endpoint. The application fails to sanitize the user parameter, which is then directly concatenated into database queries, allowing an unauthenticated attacker to inject malicious SQL commands.

The ability for an unauthenticated attacker to execute arbitrary SQL queries poses a severe risk to business operations and data integrity. Successful exploitation can lead to unauthorized access to sensitive user information, potential data exfiltration, unauthorized modification of records, and complete compromise of the backend database. With a CVSS score of 7.3, this flaw represents a significant security risk that could lead to full system takeover or prolonged service disruption.

Immediate Action: As no official patch is available from the vendor, users should immediately restrict access to the login.php endpoint or take the application offline until the code can be remediated.

Proactive Monitoring: Security teams should review web server access logs for anomalous POST requests to /login.php that contain SQL syntax, such as UNION, SELECT, or SLEEP statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block common SQL injection patterns targeting the login parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the security researcher's technical write-up provided in the referenced GitHub issue.

Given the availability of a functional proof-of-concept and the lack of a vendor-provided patch, this vulnerability must be treated with high priority. Organizations currently running the affected software should implement strict network-level access controls to the login interface immediately. Developers should prioritize refactoring the /login.php file to utilize prepared statements and parameter binding to neutralize the injection vector.