The Faculty Management System 1.0 is vulnerable to unauthenticated SQL injection, posing a risk of unauthorized database interaction.

This vulnerability is a SQL injection flaw (CWE-89) located in the subject-print.php file, which fails to properly sanitize the ID parameter. The flaw is exploitable by unauthenticated remote attackers.

The ability to perform SQL injection allows an attacker to interact directly with the backend database, potentially leading to unauthorized data disclosure or modification. With a CVSS score of 7.3, this high-severity vulnerability could compromise the integrity and confidentiality of student or faculty information, resulting in significant reputational and regulatory consequences for the institution.

Immediate Action: As no official patch is currently identified, administrators should restrict access to the affected web interface or disable the vulnerable subject-print.php functionality until a vendor update is released.

Proactive Monitoring: Security teams should monitor database logs for suspicious query patterns, such as unusual syntax or unexpected data access requests originating from the web server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting URL parameters.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up at https://github.com/wfcht-sy/src/issues/1.

Given the availability of a public proof-of-concept and the unauthenticated nature of the attack, this vulnerability represents a significant risk. Organizations utilizing the Faculty Management System 1.0 must prioritize the implementation of WAF protections or network-level access controls immediately to prevent potential exploitation while awaiting a permanent vendor-supplied security update.