A critical SQL injection vulnerability in itsourcecode Apartment Management System 1.0 allows unauthenticated remote attackers to manipulate database queries, posing a significant risk to data integrity.

This vulnerability is a SQL injection (CWE-89) located in the admin.php file of the Setting Handler component. The flaw is triggered by improper sanitization of the ddlBranch argument, allowing an unauthenticated remote attacker to inject malicious SQL commands.

The ability for an unauthenticated attacker to inject SQL queries into the application database can lead to unauthorized data exfiltration, modification, or deletion. With a CVSS score of 7.3, this high-severity flaw represents a significant risk to the confidentiality and integrity of the system data, potentially leading to a complete compromise of the management database.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected administrative interface via network-level controls or by disabling the vulnerable component entirely.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests containing SQL syntax or unusual parameters directed toward the admin.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the ddlBranch parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub repository.

Given the public availability of exploit code and the lack of a vendor-provided patch, organizations utilizing this software must prioritize isolating the affected system from public-facing networks. Immediate implementation of compensating controls such as WAF filtering is essential to mitigate the risk of unauthorized database access until a formal security update is released by the vendor.