A critical SQL injection vulnerability in the code-projects Online Job Search Engine 1.0 permits unauthenticated remote code execution or data extraction via the searchjob.php script.

This vulnerability is a classic SQL injection flaw (CWE-89) located in the searchjob.php file. An unauthenticated attacker can supply malicious input via the txtspecialization parameter to bypass security controls and interact directly with the backend database.

The ability for an unauthenticated user to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive applicant or employer data, modification of search results, or potential compromise of the underlying server. With a CVSS score of 7.3, this high-severity flaw requires immediate remediation to prevent unauthorized database access.

Immediate Action: Since no official vendor patch is currently available, administrators should restrict access to the application or disable the vulnerable searchjob.php functionality until the vendor releases a security update.

Proactive Monitoring: Monitor database query logs for unusual patterns, such as the presence of SQL syntax keywords or unexpected characters within the txtspecialization parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules designed to detect and block SQL injection payloads targeting the searchjob.php endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of public proof-of-concept material and the ease of exploitation through an unauthenticated network vector, organizations running this software are at elevated risk. We strongly recommend isolating the affected instance from public networks and applying vendor-supplied security updates the moment they become available to mitigate the threat of database compromise.