A critical SQL injection vulnerability in code-projects Question Paper Generator 1.0 allows for unauthenticated remote exploitation, posing a significant risk of database compromise.

This is a SQL injection vulnerability (CWE-89) triggered via the Fname parameter in the signupscript.php file. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N.

Successful exploitation of this flaw allows an attacker to execute arbitrary SQL commands against the backend database. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to unauthorized data exfiltration, modification of application records, or complete compromise of the database contents, directly threatening the confidentiality and integrity of the system.

Immediate Action: Since no vendor patch is currently available, administrators should restrict access to the affected script or disable the signupscript.php functionality until a security update is released by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous HTTP POST requests directed at signupscript.php containing SQL syntax characters, such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block malicious input targeting the Fname parameter to prevent SQL injection payloads from reaching the application.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the GitHub issue referenced by the CVE record.

Due to the lack of an official patch and the availability of public exploit material, this vulnerability poses an immediate threat to the environment. Organizations currently running version 1.0 of this software must prioritize isolating the affected component from public-facing networks and implement strict input validation controls to prevent unauthorized database access.