An unauthenticated SQL injection vulnerability in SourceCodester Advanced School Management System 1.0 allows remote attackers to compromise database integrity and access sensitive information.

This is a SQL injection vulnerability (CWE-89) located in the commonController.php file. The application fails to sanitize the val parameter before incorporating it into database queries, allowing an unauthenticated attacker to execute arbitrary SQL commands.

Successful exploitation of this vulnerability can lead to unauthorized access to the underlying database, potentially resulting in the exfiltration of sensitive student or administrative records. Given the CVSS score of 7.3, this flaw presents a high risk to data confidentiality and integrity, which may lead to significant operational disruption and regulatory non-compliance.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the affected endpoint or disable the vulnerable component if it is not business-critical.

Proactive Monitoring: Monitor web server logs for suspicious URL patterns containing SQL syntax or unusual characters, particularly requests targeting the commonController/checkEmail endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection attempts and malicious input patterns targeting the val parameter.

Public Exploit Available: Yes — a published proof-of-concept exists as detailed in the referenced GitHub issue.

Due to the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk. Organizations utilizing this software must prioritize restricting external access to the affected system immediately and should implement robust input validation or transition to a more secure management solution as soon as possible.