The itsourcecode University Management System 1.0 is affected by a critical SQL injection vulnerability that permits remote, unauthenticated attackers to compromise database integrity.

This vulnerability involves an improper neutralization of special elements used in an SQL command within the admin_search_student.php file. The flaw is remotely exploitable by unauthenticated attackers, as indicated by the CVSS 4.0 vector AV:N/AC:L/PR:N/UI:N.

The exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive institutional data, potential modification of student records, or the exposure of administrative credentials. With a CVSS score of 7.3, this flaw presents a high risk to organizational security, as it facilitates remote data exfiltration without requiring any prior authentication.

Immediate Action: Since no official patch is currently available, users should restrict access to the University Management System by placing it behind a secure VPN or an authenticated proxy.

Proactive Monitoring: Security teams should audit web server logs for suspicious URL parameters containing SQL syntax, specifically targeting the admin_search_student.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block common SQL injection patterns targeting the identified vulnerable script.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up at https://github.com/DaMaTou00/project/issues/1.

The presence of a public proof-of-concept significantly increases the risk of exploitation by malicious actors. Given the lack of an official patch, immediate isolation of the affected application from public-facing networks is required to prevent unauthorized database access. Prioritize migrating to a secure alternative or implementing stringent network-level access controls until the vendor provides a remediation.