A critical SQL injection vulnerability in the code-projects Online Event Judging System 1.0 allows for unauthenticated remote data manipulation.

The application is vulnerable to SQL injection via the txtsearch parameter in the review_search.php file. The vulnerability is exploitable by an unauthenticated remote attacker.

The ability to perform SQL injection allows an attacker to interact directly with the underlying database, potentially leading to unauthorized data access, modification, or deletion. With a CVSS score of 7.3, this flaw poses a significant risk to the integrity and confidentiality of the event judging data. Such incidents can result in severe reputational damage and the compromise of sensitive contestant or event information.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected installation or disable the vulnerable review_search.php component until a fix is released.

Proactive Monitoring: Monitor server access logs for suspicious HTTP requests containing SQL syntax or unusual characters directed at the review_search.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to provide a virtual patch against incoming exploit attempts.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked GitHub repository.

Given the public availability of exploit information and the ease of remote execution, this vulnerability represents an urgent security risk. Organizations currently running version 1.0 of the Online Event Judging System should prioritize isolating the application from public-facing networks until a vendor-supplied patch is applied. Continuous vigilance and the application of WAF rules are essential to minimize the attack surface until formal remediation is provided.