A critical SQL injection vulnerability in code-projects Online Event Judging System 1.0 exposes the application to remote, unauthenticated data manipulation.

This vulnerability is an SQL injection flaw (CWE-89) located in the /index.php file. An unauthenticated remote attacker can exploit this by manipulating the Username parameter to execute unauthorized database queries.

Successful exploitation allows an attacker to interact directly with the backend database, potentially leading to unauthorized data exposure, modification, or deletion. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to the integrity and confidentiality of the judging system, which could result in reputational damage and loss of trust in event outcomes.

Immediate Action: As no official patch is currently identified, administrators should restrict access to the application via network-level controls or disable the vulnerable component until a vendor-supplied update is available.

Proactive Monitoring: Review web server access logs for suspicious input patterns in the Username field, such as SQL syntax characters or unexpected query structures.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application index.php endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the technical documentation provided in the GitHub issue linked by the CVE record.

Given the availability of a public proof-of-concept and the lack of a verified vendor patch, this vulnerability presents an immediate risk to the affected system. Organizations should prioritize isolating the affected server from the public internet and implementing strict input validation or WAF rules to prevent exploitation attempts until an official remediation is released by the vendor.