A critical SQL injection vulnerability in the code-projects Student Membership System allows unauthenticated attackers to bypass authentication and gain full administrative control over the application.

This vulnerability is a SQL injection flaw located in the admin/index.php file, where user-supplied input for the username and password fields is directly concatenated into database queries without sanitization. An unauthenticated attacker can supply crafted input to bypass the authentication mechanism entirely.

Successful exploitation grants an attacker full administrative access to the Student Membership System. This allows for unauthorized data modification, deletion of records, and the creation of new administrator accounts, posing a severe risk to data integrity and system security. With a CVSS score of 7.3, this high-severity vulnerability represents a significant threat to any organization relying on this software for identity or membership management.

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict access to the /admin/index.php endpoint at the network or web server level.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the login page containing SQL syntax, such as single quotes, OR operators, or tautological logic like '1'='1'.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the login endpoint.

Public Exploit Available: Yes, a public proof-of-concept is available via the researcher's GitHub issue report.

Given the ease of exploitation and the critical nature of gaining administrative access, this vulnerability must be treated with high urgency. Organizations are advised to implement strict access controls or disable the administrative interface until a formal patch is released by the developer. Implementing input validation or transitioning to prepared statements is the only viable long-term solution to eliminate this injection risk.