An unauthenticated SQL injection vulnerability in itsourcecode Document Management System 1.0 permits remote attackers to execute arbitrary database commands, posing a critical risk to data integrity.

This is a SQL injection vulnerability (CWE-89) located in the username parameter of the /register.php endpoint. The application fails to sanitize user-provided input before processing it in database queries, allowing an unauthenticated attacker to inject malicious SQL commands.

Successful exploitation of this vulnerability can result in full unauthorized access to the underlying database, leading to sensitive data exfiltration, data tampering, or service disruption. Given the CVSS score of 7.3, this flaw is classified as High severity because it allows remote, unauthenticated attackers to compromise the confidentiality and integrity of the application's data store, directly threatening business operations.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /register.php endpoint or disable the registration feature if it is not strictly required for business operations.

Proactive Monitoring: Review database and web server access logs for anomalous patterns, such as SQL syntax errors, unusual characters in the username field, or unexpected time-based delays in server responses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the registration form.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the CVE record.

The presence of a public proof-of-concept and the lack of a vendor-supplied patch necessitate immediate defensive action. Organizations running this software should prioritize isolating the affected component and implementing robust input validation or WAF-based filtering until a secure update is provided by the vendor.