A critical SQL injection vulnerability in the Student Information Management System enables unauthenticated remote attackers to manipulate database queries, potentially leading to unauthorized data exposure.

This is a SQL injection vulnerability (CWE-89) triggered through the studentId parameter within the /admin/modules/student/index.php file. The vulnerability is remotely exploitable by an unauthenticated attacker, requiring no prior user interaction or system privileges.

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk that could lead to significant data breaches or unauthorized administrative actions. Successful exploitation allows an attacker to interact directly with the backend database, potentially compromising sensitive student information or bypassing authentication mechanisms. This exposure poses a severe threat to data privacy and regulatory compliance.

Immediate Action: Since no official vendor patch is currently available, administrators should restrict access to the /admin/modules/student/index.php endpoint or disable the affected module entirely until a security update is released by itsourcecode.

Proactive Monitoring: Review web server and database access logs for anomalous patterns, specifically looking for SQL syntax characters such as single quotes, double dashes, or common SQL injection keywords originating from external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block malicious SQL injection payloads targeting the studentId parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability report.

Given the availability of a public proof-of-concept and the ease of remote execution, this vulnerability poses a significant risk to the integrity of the Student Information Management System. Organizations currently running version 1.0 must implement strict network access controls or a WAF immediately to prevent exploitation while awaiting an official vendor patch.