An unauthenticated SQL injection vulnerability in the itsourcecode Online Enrollment System allows remote attackers to compromise the backend database and access sensitive information.

This is a SQL injection vulnerability (CWE-89) located in the /sms/login.php file. The application fails to properly sanitize the user_email parameter before using it in SQL queries, which allows an unauthenticated remote attacker to manipulate database commands.

Successful exploitation of this vulnerability can lead to unauthorized access to the application database, resulting in the theft of sensitive user data or administrative credentials. Given the CVSS score of 7.3, this flaw poses a significant risk to data confidentiality and integrity, potentially leading to full system compromise or service disruption.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the /sms/login.php endpoint via network controls or disable the application until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous POST requests to /sms/login.php containing SQL syntax characters, such as single quotes, RLIKE, or SLEEP commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the user_email parameter.

Public Exploit Available: Yes, a published proof of concept exists, as documented in the referenced GitHub issue.

Given the availability of public exploit material, this vulnerability presents an immediate risk to any deployment of the Online Enrollment System 1.0. Organizations should prioritize isolating the affected component from public networks and implementing strict input validation or WAF protections to prevent exploitation until the vendor provides a formal security update.