An unauthenticated remote SQL injection vulnerability in SourceCodester Online Exam Form Submission 1.0 poses a significant risk of unauthorized database manipulation.

The application is susceptible to SQL injection via the email parameter in the /admin/index.php file. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands, potentially exposing or modifying backend database contents.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive user data stored within the exam platform. Given the CVSS score of 7.3, this represents a high-severity risk that could result in data breaches, loss of application integrity, and potential compromise of administrative credentials if the database is not properly segmented.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the /admin/index.php endpoint or disable the affected module until a security update is released by the developer.

Proactive Monitoring: Monitor server logs for suspicious HTTP requests containing SQL syntax patterns such as UNION, SELECT, or OR 1=1 directed at the /admin/index.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the CVE record.

Due to the availability of public proof-of-concept code and the ease of exploitation, this vulnerability requires immediate attention. Organizations utilizing this software must prioritize restricting external access to the vulnerable endpoint and implement robust WAF filtering to mitigate the risk of unauthorized database interaction until a permanent fix is provided by the vendor.