The itsourcecode School Management System 1.0 is vulnerable to a critical SQL injection flaw that permits unauthenticated remote attackers to access or manipulate sensitive educational data.

This is a SQL injection vulnerability (CWE-89) located in the /subject/index.php file. The application fails to properly sanitize the ID argument, allowing an unauthenticated remote attacker to inject malicious SQL commands directly into the database query.

The exploitation of this vulnerability poses a significant risk to the confidentiality and integrity of institutional data. By performing SQL injection, an attacker can bypass authentication, exfiltrate sensitive student or faculty records, or potentially modify database contents. With a CVSS score of 7.3, this flaw represents a high-risk entry point for unauthorized actors to gain persistent access to the back-end infrastructure.

Immediate Action: Since no official vendor patch is currently available, administrators should restrict network access to the /subject/index.php endpoint or disable the affected module entirely if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns, such as UNION, SELECT, or OR 1=1, specifically targeting the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule designed to detect and block SQL injection payloads targeting the identified vulnerable endpoint.

Public Exploit Available: Yes — a public proof-of-concept exists and is documented in the researcher's GitHub issue report (https://github.com/ltranquility/CVE/issues/32).

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability requires immediate attention. Organizations utilizing the affected software must implement strict network-level filtering or WAF protections immediately to prevent unauthorized database access until an official security update is released by the vendor.