A critical SQL injection vulnerability exists in itsourcecode School Management System 1.0 that enables unauthenticated remote attackers to manipulate database queries.

The application is susceptible to SQL injection (CWE-89) because it fails to properly sanitize user input in the ID argument within the /course/index.php file, allowing an unauthenticated remote attacker to execute arbitrary SQL commands.

This vulnerability poses a significant risk to the confidentiality and integrity of the school management system. Successful exploitation could allow unauthorized parties to extract sensitive student or administrative data, modify records, or potentially bypass authentication mechanisms, resulting in severe data loss and compliance violations. With a CVSS score of 7.3, this flaw represents a high risk to organizational security.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the application or take the service offline until the vendor releases a security update.

Proactive Monitoring: Review web server access logs for anomalous URL patterns containing SQL syntax or unusual parameters directed at /course/index.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the provided GitHub issue reference.

Given the availability of public exploit material and the unauthenticated nature of the attack vector, this vulnerability must be treated with high urgency. Organizations utilizing itsourcecode School Management System 1.0 should prioritize the implementation of compensating controls, such as WAF filtering, while actively monitoring for vendor communication regarding a permanent patch.