A remote SQL injection vulnerability in SourceCodester Online Class Record System version 1.0 poses a significant risk to data integrity and system confidentiality.

The vulnerability is an SQL injection flaw residing in the admin/message/search.php file. An unauthenticated remote attacker can inject malicious SQL commands via the term parameter to interact with the underlying database.

Successful exploitation allows an attacker to execute arbitrary SQL queries, which may result in unauthorized data exfiltration, modification of database content, or disruption of administrative services. With a CVSS score of 7.3, this high-severity vulnerability highlights the potential for significant compromise of the application backend, necessitating prompt attention to prevent unauthorized access to sensitive educational or user records.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin/message/search.php endpoint or disable the affected functionality until a vendor update is released.

Proactive Monitoring: Review web server and database logs for anomalous input patterns, particularly those containing SQL syntax or unusual characters within the term parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the search.php script.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the security researcher write-up at https://github.com/xiaoccm07/cve/issues/3.

Given the public disclosure of a functional exploit and the ease of remote execution, this vulnerability represents a clear risk to the application. System administrators should prioritize isolating the affected component and implementing robust input validation or firewall rules immediately to mitigate the risk of unauthorized database interactions.