An unauthenticated SQL injection vulnerability in itsourcecode Document Management System 1.0 allows remote attackers to compromise the backend database.

The application fails to sanitize user-supplied input in the field1 parameter of the /edtlbls.php file. This flaw allows an unauthenticated remote attacker to inject malicious SQL queries, enabling unauthorized database interaction.

Successful exploitation of this SQL injection vulnerability can lead to unauthorized access to sensitive information, potential data tampering, or full compromise of the database server. Given the CVSS score of 7.3, this represents a significant security risk that could result in severe data leakage, loss of system integrity, and potential service disruption.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /edtlbls.php endpoint or disable the affected module until a vendor-supplied fix is released.

Proactive Monitoring: Security teams should review web server access logs for anomalous POST requests containing SQL syntax, such as "SLEEP," "UNION SELECT," or "RLIKE," targeting the /edtlbls.php file.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in HTTP POST parameters to provide virtual patching for this vulnerability.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the GitHub issue report referenced by the vulnerability findings.

Due to the availability of public exploit material and the lack of authentication required to execute the attack, this vulnerability poses a high risk to availability and confidentiality. Organizations using this software must prioritize restricting external access to the affected file immediately and monitor for unauthorized database activity until a formal security update is applied.