An unauthenticated SQL injection vulnerability in the itsourcecode College Management System poses a critical risk of database compromise and unauthorized data access.

The application fails to sanitize the teacher_id parameter within the /admin/teacher-salary.php file, allowing an unauthenticated remote attacker to inject malicious SQL queries.

Successful exploitation of this flaw enables attackers to bypass authentication, extract sensitive database contents, modify system data, or potentially achieve full control over the application backend. With a CVSS score of 7.3, this vulnerability represents a significant risk to data confidentiality and integrity, potentially leading to severe reputational damage and operational disruption.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/teacher-salary.php endpoint and implement strict input validation for the teacher_id parameter.

Proactive Monitoring: Security teams should audit web server access logs for anomalous POST requests to the /admin/teacher-salary.php file, specifically looking for SQL syntax patterns or time-based delay indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the identified parameter.

Public Exploit Available: Yes, a published proof-of-concept exists in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability should be treated with high priority. Organizations using the affected software must implement immediate network-level access controls and monitoring to mitigate the risk until an official vendor update is released and applied.