A critical SQL injection vulnerability exists in the itsourcecode Electronic Judging System 1.0, which allows unauthenticated remote attackers to compromise the backend database.

This is a SQL injection vulnerability (CWE-89) located in the /intrams/login.php file. An unauthenticated attacker can supply malicious input via the username parameter to manipulate backend SQL queries.

Successful exploitation allows an attacker to bypass authentication, extract sensitive data, modify database records, or potentially gain full control of the application. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, which could lead to severe operational disruption and regulatory non-compliance.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /intrams/login.php endpoint via network controls or disable the application entirely until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous request patterns, specifically looking for SQL syntax or time-based sleep commands targeting the login endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in HTTP POST parameters.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the researcher's GitHub issue report.

Due to the lack of a vendor-provided patch and the availability of public proof-of-concept code, this vulnerability poses an immediate threat to any exposed instance of the Electronic Judging System. Organizations should prioritize isolating this software from public networks and implementing strict WAF filtering to prevent unauthorized database access.