A remote SQL injection vulnerability in itsourcecode Society Management System 1.0 poses a significant risk to data integrity and database security.

This vulnerability is a SQL injection flaw (CWE-89) triggered via the expenses_id parameter in the /admin/delete_expenses.php file. The vulnerability is exploitable by unauthenticated remote attackers.

Successful exploitation allows an attacker to manipulate database queries, potentially leading to unauthorized data access, modification, or deletion. With a CVSS score of 7.3, this high-severity flaw threatens the confidentiality and integrity of the entire application database, which could result in significant operational disruption and loss of sensitive information.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory and the affected PHP script to authorized internal personnel only.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests targeting the /admin/delete_expenses.php endpoint, particularly those containing SQL syntax or unusual characters in the expenses_id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to mitigate the risk until a vendor-supplied update is released.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the technical write-up referenced at https://github.com/zpf7029/oblong/issues/2.

Given the availability of a public proof-of-concept and the unauthenticated nature of the attack, this vulnerability requires immediate attention. Until the vendor provides a formal patch, organizations must implement strict access controls and WAF filtering to prevent unauthorized database interaction.