An unauthenticated SQL injection vulnerability in the itsourcecode School Management System 1.0 allows remote attackers to execute arbitrary database commands.

This vulnerability is a SQL injection flaw (CWE-89) triggered by improper sanitization of the ID argument within the /enrollment/index.php file. The attack is remotely exploitable and does not require authentication.

The CVSS score of 7.3 highlights a significant risk of unauthorized database interaction, which can lead to data exfiltration, unauthorized modification of sensitive student records, or potential bypass of authentication mechanisms. Successful exploitation could result in a complete loss of confidentiality and integrity for the affected database, causing significant reputational damage and operational disruption.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /enrollment/index.php file or disable the affected module until the vendor releases a secure update.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected characters in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application URL structure.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced at https://github.com/ltranquility/CVE/issues/34.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a clear and present danger to the security of the School Management System. Organizations currently running version 1.0 should treat this as a high priority item, implementing strict network access controls or disabling the vulnerable component immediately to prevent potential compromise.