An unauthenticated SQL injection vulnerability in the RUET OJ platform poses a significant risk of unauthorized database manipulation and information disclosure.

The application is susceptible to SQL injection (CWE-89) within the process.php file, specifically triggered through the un parameter in a POST request. This flaw allows unauthenticated remote attackers to execute arbitrary SQL commands against the backend database.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive data stored within the database, potentially resulting in complete data compromise. Given the CVSS score of 7.3, this high-severity flaw threatens the confidentiality and integrity of the application, which may lead to significant operational disruption or loss of user trust.

Immediate Action: As no official patch is currently available from the vendor, administrators should restrict network access to the affected process.php endpoint or disable the vulnerable component entirely.

Proactive Monitoring: Monitor web server logs for suspicious POST requests targeting process.php that contain SQL syntax, such as UNION, SELECT, or comment characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection patterns in incoming POST traffic to neutralize the attack vector.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the VulDB advisory (ID 330103).

The presence of a public proof-of-concept combined with the unauthenticated nature of this SQL injection vulnerability makes this a high-priority risk. Organizations using the affected version of RUET OJ must implement immediate network-level mitigations or WAF protections, as no vendor-provided patch is available to resolve the underlying flaw.