A remote, unauthenticated SQL injection vulnerability in code-projects Online Job Search Engine 1.0 poses a significant risk of unauthorized database access and data manipulation.

This is a SQL injection vulnerability (CWE-89) affecting the registration.php file, specifically within the txtusername parameter. The vulnerability allows an unauthenticated remote attacker to inject malicious SQL queries into the application.

The ability to perform SQL injection allows an attacker to interact directly with the application database. This could lead to the unauthorized disclosure of sensitive user information, modification of job search data, or potential administrative account compromise, which aligns with the high-severity CVSS score of 7.3.

Immediate Action: As no official patch is currently available, administrators should restrict public access to the registration page or implement input validation and parameterized queries in the registration.php source file.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests targeting registration.php, specifically looking for SQL syntax patterns in the txtusername parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts directed at the registration endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability report.

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability presents an immediate risk to the confidentiality and integrity of the application. Organizations utilizing this software must implement strict WAF filtering or disable the affected registration functionality until a secure update is released by the vendor.