An unauthenticated SQL injection vulnerability in the SourceCodester Teacher Record System allows remote attackers to compromise database integrity and access sensitive information.

The application fails to properly sanitize user input within the searchteacher parameter of the /trms/search-teacher.php file. This allows an unauthenticated attacker to inject malicious SQL commands, enabling unauthorized database interaction.

Successful exploitation permits attackers to bypass authentication, extract sensitive data, modify database records, or potentially gain full control over the application backend. With a CVSS score of 7.3, this flaw poses a significant risk to data confidentiality and integrity, potentially leading to severe reputational damage and regulatory non-compliance.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the /trms/search-teacher.php endpoint or disable the affected functionality entirely.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the /trms/search-teacher.php file containing SQL-specific syntax or patterns indicative of injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the searchteacher parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub research repository linked in the CVE references.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations currently utilizing this software must implement strict network-level access controls or WAF filtering to prevent unauthorized database access while awaiting a permanent security update from the vendor.