A critical SQL injection vulnerability in the itsourcecode Event Management System 1.0 allows unauthenticated remote attackers to compromise the backend database.

This flaw is a SQL injection vulnerability (CWE-89) located in the /admin/ajax.php file within the admin login function. The vulnerability is exploitable by an unauthenticated remote attacker via the username parameter.

Successful exploitation of this vulnerability permits unauthorized interaction with the application database. This could lead to the exposure of sensitive administrative credentials, unauthorized access to system data, or potential modification of application records. Given the CVSS score of 7.3, this represents a significant risk to the integrity and confidentiality of the affected management system.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin/ directory using network-level controls or IP allowlisting.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous requests to /admin/ajax.php, particularly those containing SQL syntax or unusual character patterns in the username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns targeting the login endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

The presence of a publicly available exploit for an unauthenticated SQL injection vulnerability makes this a high-priority concern. Organizations currently running version 1.0 of the itsourcecode Event Management System must implement immediate compensating controls to shield the admin login interface from unauthorized access while awaiting a vendor-supplied security update.