An unauthenticated SQL injection vulnerability in the itsourcecode School Management System 1.0 allows remote attackers to compromise the underlying database.

The application fails to properly sanitize user input in the ID parameter within the /student/index.php file, resulting in an unauthenticated SQL injection vulnerability. This flaw allows remote attackers to execute arbitrary SQL commands against the database.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive student data, potential database modification, or complete service disruption. Given the CVSS score of 7.3, this represents a high-severity risk that could facilitate data exfiltration or unauthorized system manipulation.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the affected /student/index.php endpoint or disable the vulnerable module until a fix is provided.

Proactive Monitoring: Monitor database query logs for unusual syntax, such as union-based injections or unexpected character sequences, that indicate an active attempt to exploit the SQL vulnerability.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the ID parameter.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced in the GitHub issue tracker.

The presence of a public exploit for this unauthenticated vulnerability necessitates immediate defensive action. Organizations utilizing the itsourcecode School Management System should prioritize the implementation of WAF rules or network-level access controls to protect the application while awaiting a formal vendor security update.