A critical SQL injection vulnerability in code-projects Online Job Search Engine 1.0 allows unauthenticated remote attackers to compromise database integrity.

This is a SQL injection vulnerability (CWE-89) residing in the postjob.php file. The vulnerability is triggered by an unauthenticated attacker manipulating the txtjobID parameter, allowing for unauthorized interaction with the underlying database.

The ability for an unauthenticated remote attacker to perform SQL injection poses a significant risk to data confidentiality and integrity. With a CVSS score of 7.3, this high-severity flaw could lead to unauthorized data exfiltration, modification of job postings, or potential administrative account compromise depending on the database configuration.

Immediate Action: Since a vendor-supplied patch is currently unknown, administrators should restrict access to the affected postjob.php endpoint at the network or web application level.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting postjob.php, specifically looking for SQL syntax patterns or unexpected character strings in the txtjobID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection payloads targeting the application.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the vulnerability report at https://github.com/iMayday-Yee/Vulnerability/issues/5.

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability requires immediate attention. Organizations utilizing this software must implement strict input validation or restrict access to the vulnerable endpoint until a formal vendor update is released and applied.