A critical SQL injection vulnerability in code-projects Student File Management System 1.0 allows for remote, unauthenticated database manipulation.

This vulnerability is a SQL injection flaw located in the delete_user.php file within the admin directory. An unauthenticated remote attacker can manipulate the user_id argument to execute arbitrary SQL commands against the backend database.

The ability for an unauthenticated attacker to inject SQL commands poses a severe risk to the confidentiality and integrity of the application data. Successful exploitation could lead to unauthorized access to user records, sensitive information disclosure, or potential administrative account takeover, justifying the CVSS score of 7.3.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /admin/ directory using IP allowlisting or VPN authentication.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests targeting the /admin/delete_user.php file, particularly those containing SQL syntax characters like single quotes or semicolons.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the identified vulnerable endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists via the researcher's GitHub issue report.

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability presents a significant risk to affected installations. Organizations must prioritize immediate network-level access controls to shield the vulnerable endpoint until a formal security update is released by the developer.