An unauthenticated SQL injection vulnerability in SourceCodester School Registration and Fee System 1.0 allows remote attackers to execute arbitrary database queries, posing a severe risk to data integrity.

The application fails to properly sanitize user input within the status parameter of the /bilal/normal/save_stud.php file. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands, enabling unauthorized database access and manipulation.

A successful exploit of this vulnerability could lead to the complete compromise of the backend database, resulting in the unauthorized disclosure, modification, or deletion of sensitive student and financial records. Given the CVSS score of 7.3, this represents a high-severity risk that could cause significant reputational damage, operational disruption, and potential non-compliance with data privacy regulations.

Immediate Action: As there is no official vendor patch available, administrators should restrict network access to the application or take the system offline until code-level remediation, such as implementing prepared statements for the status parameter, can be applied.

Proactive Monitoring: Monitor web server access logs for suspicious POST requests to /bilal/normal/save_stud.php, specifically looking for time-based delay patterns or SQL syntax fragments in the status parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting POST request parameters.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the researcher's GitHub issue report.

Given the availability of a public proof-of-concept and the lack of an official patch, this vulnerability presents a clear and immediate danger to any exposed instances of the School Registration and Fee System. Organizations currently running version 1.0 must treat this as a critical priority, implementing strict network access controls or disabling the affected functionality until secure, validated code changes are implemented and verified.