An unauthenticated SQL injection vulnerability in the itsourcecode Document Management System 1.0 allows remote attackers to compromise database integrity and potentially gain unauthorized access.

The application fails to properly sanitize user input provided through the username parameter in the /loging.php file. An unauthenticated attacker can inject malicious SQL commands into this parameter to interfere with backend database operations.

Successful exploitation of this SQL injection vulnerability poses a significant risk to the confidentiality, integrity, and availability of the system. An attacker can extract sensitive data, modify database contents, or potentially disrupt service, which may lead to severe operational downtime and data breaches. Given the CVSS score of 7.3, this flaw represents a high-severity risk that requires immediate attention to prevent unauthorized database access.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /loging.php endpoint using network-level controls or a Web Application Firewall (WAF) to block malicious SQL patterns.

Proactive Monitoring: Review web server access logs for anomalous POST requests to /loging.php containing SQL syntax, such as keywords like SLEEP, UNION, or OR, which may indicate exploitation attempts.

Compensating Controls: Implement strict input validation or use prepared statements for the username parameter in the source code if internal development resources allow for custom remediation.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the referenced security researcher's GitHub repository.

Due to the availability of public proof-of-concept code and the ease of exploitation, this vulnerability should be treated with high urgency. Organizations utilizing the itsourcecode Document Management System 1.0 must immediately implement compensating controls to block external access to the vulnerable login endpoint until a vendor-supplied security update is released and applied.