An unauthenticated SQL injection vulnerability in itsourcecode Directory Management System 1.0 poses a significant risk of unauthorized database access and potential data compromise.

This flaw is a SQL injection vulnerability (CWE-89) located in the /admin/forget-password.php script. An unauthenticated remote attacker can inject malicious SQL queries through the email argument to manipulate database operations.

Successful exploitation of this vulnerability allows an attacker to interact directly with the backend database, potentially leading to the unauthorized disclosure or modification of sensitive administrative and user data. With a CVSS score of 7.3, this issue represents a high-severity risk that could facilitate account takeovers or broader system compromise if left unmitigated.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the /admin/forget-password.php endpoint or disable the directory management system until a security update is released.

Proactive Monitoring: Security teams should monitor web server logs for suspicious URL patterns targeting the forget-password.php file, particularly those containing SQL syntax or encoded characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeted at the application's input fields.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided in the GitHub issue referenced in the vulnerability record.

Given the availability of a public proof-of-concept and the unauthenticated nature of this vulnerability, immediate defensive action is required. Organizations using the Directory Management System should isolate the affected instance from public-facing networks until the vendor provides a secure update to address the underlying code flaw.