An unauthenticated SQL injection vulnerability in itsourcecode Event Management System 1.0 permits remote attackers to execute arbitrary database queries, posing a severe risk to data integrity and system security.

This is a SQL injection vulnerability (CWE-89) located in the id parameter of the /admin/index.php file. The application fails to properly sanitize user input, allowing an unauthenticated remote attacker to inject malicious SQL commands directly into the database backend.

Successful exploitation of this vulnerability allows unauthorized access to the underlying database, potentially leading to sensitive data leakage, unauthorized data modification, or complete system compromise. With a CVSS score of 7.3, this flaw represents a significant risk to business continuity and data confidentiality, as it requires no prior authentication to execute.

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict access to the /admin/index.php endpoint via network controls or web server configuration.

Proactive Monitoring: Review web server access logs for suspicious GET requests containing SQL syntax patterns or time based sleep functions directed at the /admin/index.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the id parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue linked in the CVE references.

Due to the lack of an official patch and the public availability of exploitation details, this vulnerability presents an elevated risk. Organizations running this software should prioritize isolating the application from external networks or implementing strict input validation and WAF rules to prevent unauthorized database access until a vendor-supplied update is released.