A critical SQL injection vulnerability in itsourcecode Sports Management System 1.0 allows unauthenticated remote attackers to execute arbitrary database queries.

This vulnerability is a SQL injection flaw (CWE-89) located in the /Admin/sporttype.php file. An unauthenticated attacker can supply malicious input to the code argument to interfere with database operations.

Successful exploitation allows unauthorized interaction with the underlying database, which may lead to data exposure, modification, or potential loss of system integrity. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to the confidentiality and availability of the application data.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /Admin/ directory to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns targeted at the /Admin/sporttype.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming requests containing SQL injection payloads directed at the vulnerable parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability research.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability presents a notable risk to the environment. IT teams should prioritize isolating the affected system or applying strict network-level access controls to prevent unauthorized access until an official security update is released.