An unauthenticated SQL injection vulnerability in itsourcecode Society Management System 1.0 allows remote attackers to manipulate database queries.

This vulnerability is a SQL injection flaw located in the /admin/edit_student_query.php file. An unauthenticated remote attacker can inject malicious SQL commands by manipulating the student_id argument.

Successful exploitation of this vulnerability allows unauthorized database interaction, which may lead to the exposure, modification, or deletion of sensitive student and system data. With a CVSS score of 7.3, this represents a significant risk to data integrity and confidentiality. Organizations relying on this system could face severe reputational damage and potential regulatory penalties due to unauthorized access to personal information.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory and the affected file to trusted IP addresses only.

Proactive Monitoring: Monitor server access logs for anomalous GET or POST requests directed at /admin/edit_student_query.php containing SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection patterns targeting the student_id parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability poses a credible threat to the integrity of the Society Management System. Administrators must treat this as a high-priority risk and implement restrictive access controls or disable the vulnerable functionality until an official vendor update is released.