An unauthenticated SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to execute arbitrary database queries, posing a critical risk to data integrity.

The application fails to sanitize the fname parameter in /admin/modal_add_product.php before passing it to a mysqli_query function. This allows an unauthenticated remote attacker to inject malicious SQL commands to manipulate database operations.

Successful exploitation of this vulnerability grants an attacker the ability to read, modify, or delete sensitive data stored within the backend database. Given the CVSS score of 7.3, this flaw represents a significant risk to organizational confidentiality and availability, as it provides a direct vector for total database compromise and potential service disruption.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /admin/ directory and evaluate the necessity of the application until the vendor provides a secure update.

Proactive Monitoring: Monitor web server logs for suspicious POST requests to /admin/modal_add_product.php, specifically looking for payloads containing SQL keywords such as UNION, SELECT, or SLEEP.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the fname parameter.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the researcher's GitHub write-up.

The presence of a public proof-of-concept for this unauthenticated SQL injection vulnerability necessitates urgent attention. Organizations currently running this software should treat the system as compromised if exposed to the public internet and move to restrict access immediately. Implement the suggested compensating controls and maintain a heightened state of monitoring until a formal security update is released by the vendor.