An unauthenticated SQL injection vulnerability in the itsourcecode Online Enrollment System 1.0 allows remote attackers to compromise the underlying database.

This vulnerability is a SQL injection flaw (CWE-89) located in the deptname parameter of the application. An unauthenticated attacker can supply malicious input to this parameter to execute arbitrary SQL commands against the database.

Successful exploitation allows an attacker to gain unauthorized access to the system database, leading to potential sensitive data leakage, data tampering, or full system compromise. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of institutional records managed by the enrollment system, potentially resulting in severe operational disruption and loss of trust.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the affected enrollment portal from external networks using a firewall or VPN.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at the /sms/gradelevel/controller.php or index.php files, specifically looking for SQL-related keywords or encoded characters in the deptname field.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection patterns targeting the identified vulnerable parameters.

Public Exploit Available: Yes, a public proof-of-concept exists as detailed in the referenced GitHub issue.

The severity of this vulnerability, combined with the availability of public proof-of-concept code, necessitates immediate defensive action. Administrators must isolate the vulnerable system from public access until the vendor provides a security update that implements prepared statements or strict input validation to remediate the injection flaw.