A critical SQL injection vulnerability in StudIP allows remote unauthenticated attackers to execute arbitrary code and access sensitive information, necessitating an immediate update.

This is a SQL Injection vulnerability affecting the store() functions. It allows an unauthenticated remote attacker to manipulate database queries, leading to unauthorized data exposure and the potential for remote code execution.

The CVSS score of 9.1 reflects the extreme risk of this vulnerability. Successful exploitation permits an attacker to bypass authentication and interact directly with the backend database. This can lead to total compromise of student or user data, system-wide data breaches, and potential takeover of the host server.

Immediate Action: Update StudIP to version 6.0.3 or 5.4.12 immediately to remediate the SQL injection flaw.

Proactive Monitoring: Monitor database query logs for unusual syntax, large volumes of unauthorized requests, or attempts to access sensitive tables.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to block malicious payloads targeting the application input fields.

Public Exploit Available: Unknown

Given the existence of a proof-of-concept and the critical nature of SQL injection, this vulnerability poses an urgent threat. All instances of StudIP within the specified version ranges must be patched immediately to prevent unauthorized access and potential code execution.