A critical SQL injection vulnerability in itsourcecode School Management System 1.0 allows unauthenticated remote attackers to compromise the underlying database.

This is a SQL injection (CWE-89) flaw located in the /ramonsys/settings/index.php file. An unauthenticated attacker can inject arbitrary SQL commands through the id parameter, which is processed by the application without sufficient sanitization or validation.

Successful exploitation of this vulnerability permits unauthorized database access, which may lead to the exposure of sensitive student or administrative data, unauthorized modification of records, or potential system-wide compromise. Given the CVSS score of 7.3, this flaw represents a significant risk to data confidentiality and integrity, particularly for educational institutions managing private records.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the /ramonsys/settings/index.php endpoint at the network or web server level. Disable the affected module if it is not strictly required for daily business operations.

Proactive Monitoring: Monitor web server access logs for anomalous GET requests targeting the id parameter, specifically looking for SQL syntax patterns like SLEEP, UNION, or SELECT statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the id parameter. Ensure the database service account operates with the principle of least privilege to limit the impact of potential queries.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher's GitHub repository.

The presence of a public proof-of-concept significantly increases the risk of exploitation by automated scanners and malicious actors. Organizations currently running version 1.0 of the itsourcecode School Management System must prioritize the implementation of WAF filtering and strict access controls until a formal security patch is released by the vendor.