An unauthenticated SQL injection vulnerability in SourceCodester School Registration and Fee System 1.0 allows remote attackers to compromise database integrity and access sensitive information.

The application fails to properly sanitize user-supplied input in the selector[] parameter within the /bilal/normal/delete_stud.php file. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands, enabling unauthorized database queries and data manipulation.

Successful exploitation of this vulnerability poses a severe risk to the confidentiality and integrity of institutional data. An attacker can extract sensitive student and financial records, modify database contents, or potentially disrupt service availability. With a CVSS score of 7.3, this flaw is categorized as high severity, indicating that the potential for data breach and unauthorized system control is significant.

Immediate Action: As no official patch is available from the vendor, users should restrict access to the affected endpoint at the network level or disable the vulnerable module until a security update is released.

Proactive Monitoring: Security teams should monitor database access logs for anomalous query patterns, specifically looking for time-based blind SQL injection payloads or unusual request volumes targeting the delete_stud.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules configured to detect and block SQL injection attempts targeting the POST parameter selector[].

Public Exploit Available: Yes, a proof-of-concept exists as documented in the GitHub issue report referenced by the CVE.

Given the ease of exploitation and the lack of an official vendor patch, this vulnerability presents a high risk to organizations utilizing the affected software. Administrators must prioritize isolating the vulnerable application from public-facing networks and implementing strict input validation rules at the application or WAF layer to prevent unauthorized database access.