A critical SQL injection vulnerability in itsourcecode Sports Management System 1.0 enables unauthenticated remote attackers to compromise database integrity.

This is a SQL injection vulnerability (CWE-89) located in the /Admin/tournament_details.php file. The application fails to properly sanitize the ID parameter, allowing an unauthenticated attacker to inject malicious SQL commands into the database query.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive data stored within the underlying database. Given the CVSS score of 7.3, this represents a significant risk to confidentiality and integrity, potentially resulting in data exfiltration or unauthorized modification of system records.

Immediate Action: Since a formal vendor patch is currently unavailable, administrators should restrict network access to the /Admin/ directory to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual characters directed at the tournament_details.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the application.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked GitHub issue reference.

The presence of a public proof-of-concept renders this vulnerability a priority for immediate risk mitigation. Organizations utilizing the affected software must implement network-level restrictions or WAF rules immediately, as no official vendor patch is currently available to resolve the underlying code flaw.