The itsourcecode Student Management System is vulnerable to a remote SQL injection flaw that could allow unauthorized database manipulation.

This vulnerability is a SQL injection (CWE-89) affecting the enrollment controller.php file, where an unauthenticated attacker can supply malicious input via the ID parameter to interact directly with the backend database.

The ability to perform remote SQL injection poses a significant risk to data confidentiality and integrity. An attacker could potentially extract sensitive student records, modify system data, or disrupt service availability. With a CVSS score of 7.3, this flaw represents a high-severity risk that requires immediate attention to prevent unauthorized database access.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected enrollment module or isolate the system from public-facing networks.

Proactive Monitoring: Review web server access logs for anomalous GET or POST requests directed at the enrollment controller.php file, particularly those containing SQL syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns targeting URI parameters.

Public Exploit Available: Yes, a public proof-of-concept exists as detailed in the GitHub issue referenced in the CVE record.

Due to the lack of an official patch and the availability of a public proof-of-concept, users of the Student Management System 1.0 must prioritize network-level isolation or the implementation of strict WAF filtering. Given the ease of exploitation for this SQL injection, continuous monitoring of database logs is essential until a formal update is provided by the vendor.