A critical SQL injection vulnerability in the itsourcecode University Management System allows unauthenticated remote attackers to manipulate database queries and potentially compromise sensitive information.

This is a SQL injection vulnerability (CWE-89) located in the /view_result.php file. The application fails to sanitize the seme parameter, allowing an unauthenticated remote attacker to inject malicious SQL commands directly into the database query.

Successful exploitation allows unauthorized access to the underlying database, which may lead to the exfiltration of sensitive university records, data tampering, or total system compromise. Given the CVSS score of 7.3, this flaw poses a high risk to data integrity and confidentiality, potentially resulting in significant reputational damage and operational disruption.

Immediate Action: As no vendor patch is currently available, administrators should restrict public access to the /view_result.php endpoint or disable the affected module entirely until a secure update is provided.

Proactive Monitoring: Review web server access logs for anomalous POST requests containing SQL syntax, such as UNION statements or time-based sleep commands targeting the seme parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection patterns directed at the /view_result.php file.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the security researcher's write-up on GitHub.

The presence of a functional proof-of-concept for this unauthenticated SQL injection vulnerability makes it a high-priority risk. Organizations currently utilizing the itsourcecode University Management System should immediately isolate the affected component from external networks and prioritize the implementation of strict input validation or WAF-based filtering to prevent unauthorized database access.