A critical SQL injection vulnerability in the itsourcecode Student Management System allows unauthenticated remote attackers to manipulate database queries.

This vulnerability is a SQL Injection (CWE-89) flaw located in the /ramonsys/billing/index.php file. An unauthenticated remote attacker can inject malicious SQL commands by manipulating the ID parameter, potentially leading to unauthorized database access or information disclosure.

Successful exploitation of this vulnerability could lead to the unauthorized disclosure or modification of sensitive student data stored within the management system. Given the CVSS score of 7.3, this represents a significant risk to data integrity and system confidentiality, which may result in regulatory non-compliance and reputational damage for the educational institution.

Immediate Action: Since no official vendor patch is currently available, administrators should immediately restrict access to the /ramonsys/billing/index.php endpoint via network controls or disable the affected module entirely.

Proactive Monitoring: Review web server access logs for anomalous traffic patterns, specifically looking for URL requests containing SQL syntax or suspicious characters in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the linked GitHub issue reference.

The presence of a public proof-of-concept combined with the unauthenticated nature of this SQL injection flaw necessitates immediate intervention. System administrators must prioritize isolating the affected component from public network access until a vendor-supplied security update is released and validated.