The code-projects Online Event Judging System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to manipulate database queries.

This vulnerability is a SQL injection flaw (CWE-89) located in the home.php file. An unauthenticated remote attacker can trigger the flaw by manipulating the main_event input parameter.

The ability to perform remote SQL injection allows an attacker to potentially bypass authentication, access sensitive data, or modify database contents. With a CVSS score of 7.3, this high-severity vulnerability poses a significant risk to the integrity and confidentiality of the event data stored within the application. Failure to remediate could lead to unauthorized data exfiltration or total compromise of the application database.

Immediate Action: As no official patch is currently available, users should restrict access to the application or implement strict input validation on the main_event parameter to neutralize malicious SQL payloads.

Proactive Monitoring: Security teams should monitor web server logs for suspicious URL patterns containing SQL syntax or unusual input in the main_event parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns targeting the application.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the GitHub issue referenced by the CVE record.

Given the availability of a public proof-of-concept and the ease of exploitation over a network, this vulnerability presents an immediate risk. Organizations utilizing the Online Event Judging System 1.0 must prioritize implementing network-level blocks or WAF protections immediately, as a vendor-supplied patch is currently unavailable. Continuous monitoring for indicators of compromise is essential until a formal fix is released by the vendor.