A critical SQL injection vulnerability in the itsourcecode Sports Management System 1.0 allows for remote unauthorized database interaction.

This vulnerability is a SQL injection flaw (CWE-89) located within the /Admin/facilitator.php file. An unauthenticated remote attacker can manipulate the code argument to execute arbitrary SQL commands against the backend database.

The ability to perform SQL injection poses a significant risk to the confidentiality, integrity, and availability of the application database. With a CVSS score of 7.3, this high-severity flaw could allow an attacker to exfiltrate sensitive user data, modify administrative records, or disrupt system operations. Such unauthorized access can lead to severe reputational damage and potential regulatory non-compliance regarding data protection.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the /Admin/facilitator.php endpoint at the network or application level.

Proactive Monitoring: Security teams should monitor database logs for anomalous query patterns, such as unexpected syntax errors or suspicious SQL keywords originating from external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated SQL injection protection rules to inspect and block malicious input targeting the code parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the researcher's write-up at https://github.com/zzb1388/cve/issues/59.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability presents an immediate and elevated risk. Organizations utilizing itsourcecode Sports Management System 1.0 must prioritize isolating the affected component from the public internet and implementing strict input validation or WAF-based filtering to prevent exploitation.