A critical SQL injection vulnerability in the itsourcecode Society Management System 1.0 poses a significant risk of unauthorized database interaction for remote, unauthenticated attackers.

The application is vulnerable to SQL injection (CWE-89) within the edit_expenses_query.php file. An unauthenticated remote attacker can inject malicious SQL commands by manipulating the detail parameter.

The ability for an unauthenticated attacker to execute arbitrary SQL queries allows for unauthorized access to sensitive application data, potential modification of records, or administrative bypass. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to full compromise of the application database and associated business information.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the management interface and consider disabling the affected file or the entire application until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for anomalous requests to the /admin/edit_expenses_query.php endpoint, specifically looking for SQL syntax patterns or unexpected character strings in the detail parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and block malicious payloads targeting the vulnerable parameter.

Public Exploit Available: Yes — a published proof-of-concept exists and is documented in the referenced GitHub issue.

This vulnerability presents a clear and present danger due to the availability of public proof-of-concept material and the lack of authentication requirements. Organizations utilizing this software must prioritize isolating the affected system from public-facing networks immediately and monitor vendor channels for the release of a security patch to remediate this flaw.