An unauthenticated SQL injection vulnerability in itsourcecode School Management System 1.0 allows remote attackers to execute arbitrary database commands, posing a significant risk to data integrity.

This is a SQL injection vulnerability (CWE-89) triggered by the improper sanitization of the ay argument within the /ramonsys/report/index.php file. The vulnerability is remotely exploitable by an unauthenticated attacker.

Successful exploitation allows an attacker to manipulate backend database queries, potentially leading to unauthorized data access, modification, or deletion. Given the CVSS score of 7.3, this high-severity flaw threatens the confidentiality and integrity of school records and sensitive user information stored within the system.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected script or disable the vulnerable module until a security update is released by the vendor.

Proactive Monitoring: Security teams should monitor database logs for anomalous query patterns or syntax errors that indicate SQL injection attempts targeting the report index file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads directed at the /ramonsys/report/index.php endpoint.

Public Exploit Available: Yes — a public proof-of-concept exists, attributed to the researcher's disclosure on GitHub.

The presence of a public proof-of-concept significantly lowers the barrier for exploitation by malicious actors. Organizations currently running version 1.0 of this software must prioritize network-level protections and implement strict access controls immediately to mitigate the risk of unauthorized database interaction.