A critical SQL injection vulnerability in itsourcecode Document Management System 1.0 allows unauthenticated remote attackers to compromise the backend database.

This is a SQL injection vulnerability (CWE-89) located in the /deluser.php file. An unauthenticated attacker can manipulate the user2del POST parameter to inject malicious SQL queries, which the application fails to sanitize before execution.

The ability for an unauthenticated remote attacker to perform SQL injection poses a severe risk to organizational data integrity and confidentiality. Successful exploitation could lead to unauthorized database access, sensitive data exfiltration, data modification, or complete system compromise. With a CVSS score of 7.3, this vulnerability represents a high-risk entry point that could facilitate broader network lateral movement if the application is not properly isolated.

Immediate Action: As there is no official patch available, administrators should immediately restrict access to the /deluser.php file at the network or web server level. If the functionality is not required, disable or remove the file entirely from the production environment.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at /deluser.php, particularly those containing SQL syntax characters like single quotes, RLIKE, or SLEEP commands. Monitor database logs for unusual query patterns or unexpected administrative actions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the user2del parameter. Ensure that the database service account is configured with the principle of least privilege to limit the impact of a potential injection attack.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research write-up found at the provided GitHub repository.

The presence of a public proof-of-concept combined with the lack of authentication requirements makes this a high-priority concern for any organization running this software. Given the absence of a vendor-supplied patch, immediate implementation of access controls and WAF filtering is essential to mitigate the risk of unauthorized database exploitation. Organizations should prioritize replacing or isolating this legacy software to prevent further exposure.