A critical SQL injection vulnerability in code-projects Class and Exam Timetable Management 1.0 allows unauthenticated remote attackers to compromise the application database.

This vulnerability is a SQL injection flaw (CWE-89) located in the login component of the index.php file. An unauthenticated attacker can manipulate the username or password arguments to execute arbitrary SQL commands against the database.

The ability for an unauthenticated attacker to inject SQL commands poses a significant threat to data confidentiality and integrity. With a CVSS score of 7.3, this flaw could lead to the unauthorized extraction of sensitive user credentials, administrative access, or total database compromise. Such an event would likely result in severe reputational damage and potential regulatory non-compliance regarding data protection.

Immediate Action: As no official patch is currently available, administrators should restrict access to the application or take the service offline until a secure update is provided by the vendor.

Proactive Monitoring: Monitor database query logs for unusual syntax, such as union selects or unexpected character patterns, which indicate active injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to filter malicious payloads targeting the login endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability record.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations utilizing this software must implement compensating controls, such as WAF filtering, and prioritize isolating the application from external networks to prevent unauthorized data access while awaiting a vendor-supplied patch.