The itsourcecode School Management System is vulnerable to remote SQL injection, which could allow an unauthenticated attacker to compromise backend database integrity.

This flaw is a SQL injection vulnerability (CWE-89) triggered by improper sanitization of the txtsearch argument within the /ramonsys/inquiry/index.php file. The vulnerability is remotely exploitable by an unauthenticated attacker.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive institutional data, potential data modification, or service disruption. With a CVSS score of 7.3, this represents a significant security risk that could facilitate unauthorized database queries, potentially leading to the exposure of student or administrative records.

Immediate Action: Since a formal vendor patch is currently unknown, administrators should restrict access to the affected directory or the School Management System interface until a security update is provided.

Proactive Monitoring: Review web server access logs for suspicious patterns, specifically focusing on unexpected characters or SQL syntax within the txtsearch parameter of the inquiry module.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests containing malicious SQL payloads targeting the /ramonsys/inquiry/index.php endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical reference provided by VulDB and associated exploit archives.

The presence of a public proof-of-concept for this SQL injection vulnerability necessitates immediate defensive action. Given that an official patch is not yet confirmed, organizations must prioritize network-level mitigations, such as WAF rules and access control restrictions, to prevent unauthorized database interaction and potential data exfiltration.