A remote SQL injection vulnerability in the saiftheboss7 onlinemcqexam application allows unauthenticated attackers to manipulate database queries.

This is a SQL injection vulnerability (CWE-89) occurring in the /admin/quesadd.php script. An unauthenticated remote attacker can inject malicious SQL commands by manipulating the ans1 or ans2 parameters.

Successful exploitation allows an attacker to interact directly with the application database, potentially leading to unauthorized data access, modification, or deletion. With a CVSS score of 7.3, this flaw poses a significant risk to the confidentiality and integrity of the exam data managed by the platform.

Immediate Action: As no official patch is currently available, users should restrict network access to the /admin/ directory or deactivate the application until a fix is released.

Proactive Monitoring: Inspect web server access logs for anomalous requests to /admin/quesadd.php containing SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block incoming requests containing common SQL injection patterns targeting the ans1 and ans2 parameters.

Public Exploit Available: Yes — a published proof-of-concept exists in the referenced GitHub issue tracker.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a credible threat. Administrators must prioritize isolating the affected component and implementing WAF protections immediately to prevent unauthorized database access while awaiting a vendor-provided update.