A critical SQL injection vulnerability in the itsourcecode Society Management System 1.0 allows for remote, unauthenticated database manipulation.

This vulnerability is a SQL injection (CWE-89) flaw located in the admin/add_expenses.php file. An unauthenticated attacker can exploit this by injecting malicious SQL commands into the detail parameter to interact with the underlying database.

With a CVSS score of 7.3, this vulnerability represents a significant risk to data integrity and confidentiality. Successful exploitation could allow an attacker to bypass security controls, extract sensitive information from the database, or potentially compromise the application backend, leading to complete unauthorized access to system data.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory and implement strict input validation on the detail parameter to sanitize user input.

Proactive Monitoring: Review web server access logs for anomalous request patterns targeting /admin/add_expenses.php, specifically looking for SQL syntax characters or unexpected parameter lengths.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting administrative endpoints.

Public Exploit Available: Yes — a public proof-of-concept exists via the GitHub issue referenced in the vendor documentation.

Given the public availability of exploit code and the ease of exploitation, this vulnerability poses a clear and present danger to affected deployments. Organizations should prioritize isolating the affected management interface from public-facing networks until a vendor-supplied security update is applied.