A remote SQL injection vulnerability in code-projects Online Course Registration 1.0 poses a significant risk of unauthorized database interaction.

This vulnerability is a SQL injection (CWE-89) flaw located in the /admin/manage-students.php file. An unauthenticated remote attacker can trigger this issue by manipulating the ID argument.

Successful exploitation of this SQL injection vulnerability allows an attacker to manipulate backend database queries. Given the CVSS score of 7.3, this represents a high severity risk that could lead to unauthorized data exposure, potential modification of student records, or disruption of administrative functions, directly impacting the integrity and availability of the registration system.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/manage-students.php endpoint or disable the application until a vendor-supplied fix is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected characters targeting the manage-students.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to filter and block malicious SQL injection payloads targeting the ID parameter on the affected endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the CVE enrichment data.

The presence of a public proof-of-concept significantly elevates the risk of exploitation for this high-severity flaw. Organizations currently utilizing Online Course Registration 1.0 must prioritize implementing compensating controls, such as WAF filtering, and isolate the vulnerable administrative endpoints from public exposure until the vendor provides a formal security update.