A critical SQL injection vulnerability in the itsourcecode College Management System allows unauthenticated remote attackers to compromise database integrity and potentially gain unauthorized access.

This is a SQL injection vulnerability (CWE-89) located in the /login/login.php file. The application fails to sanitize the email parameter during the authentication process, allowing an unauthenticated attacker to inject malicious SQL commands.

Successful exploitation of this vulnerability could lead to unauthorized database access, sensitive data leakage, and potential system compromise. Given the CVSS score of 7.3, this flaw poses a significant risk to the confidentiality and integrity of the data stored within the College Management System, potentially resulting in service disruption or regulatory non-compliance.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the login portal via network-level controls and implement input validation as a temporary measure.

Proactive Monitoring: Security teams should review web server access logs for anomalous POST requests to /login/login.php, specifically monitoring for SQL syntax patterns or time-based blind SQL injection strings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the email parameter.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the security researcher's write-up on GitHub.

Due to the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability presents an immediate risk to any deployment of the College Management System version 1.0. Organizations must prioritize isolating the affected application from public-facing networks until a secure update is released or the underlying code is manually remediated using prepared statements.