A critical SQL injection vulnerability in SourceCodester Online Exam Form Submission 1.0 exposes the application to unauthorized database manipulation by unauthenticated remote attackers.

This is a SQL injection vulnerability (CWE-89) occurring within the index.php file. An unauthenticated attacker can exploit this flaw by injecting malicious SQL commands into the usn parameter to interact directly with the backend database.

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk. Successful exploitation could lead to unauthorized data exposure, modification, or deletion of records within the exam system, potentially compromising sensitive user information and undermining the integrity of examination results.

Immediate Action: As no official patch is currently available, administrators should restrict access to the application or disable the affected functionality until a secure update is released by the vendor.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests targeting the index.php file, specifically looking for unusual character patterns or SQL syntax within the usn parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection attempts directed at the application's input parameters.

Public Exploit Available: Yes, a public proof of concept is available via the referenced GitHub advisory.

Given the availability of a public exploit and the lack of a vendor patch, this vulnerability poses a significant risk to the availability and confidentiality of the affected system. Organizations should prioritize isolating the vulnerable application from public-facing networks until a vendor-supplied security update is applied to remediate the underlying injection flaw.