A critical SQL injection vulnerability in code-projects Assessment Management 1.0 allows unauthenticated attackers to execute unauthorized database commands, posing a high risk to data integrity.

This is a SQL injection vulnerability (CWE-89) located in the add-module.php script. An unauthenticated attacker can inject malicious payloads into the linked[] parameter, which is processed by the backend database without sufficient sanitization.

Successful exploitation of this flaw allows an attacker to bypass security controls to read, modify, or delete sensitive data stored within the backend database. Given the CVSS score of 7.3, this represents a significant risk that could lead to complete system compromise, unauthorized access to administrative functions, or extended service disruption.

Immediate Action: As there is no official patch available, administrators should restrict access to the /admin/ directory using network-level controls or web server authentication until a fix is provided by the vendor.

Proactive Monitoring: Review web server and database logs for anomalous POST requests to the /admin/add-module.php endpoint, specifically looking for characters indicative of SQL injection such as single quotes, sleep commands, or union statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the linked[] parameter.

Public Exploit Available: Yes, a functional proof-of-concept payload and request packet were published in the researcher's GitHub write-up.

Given the availability of public exploit details and the ease of triggering this vulnerability, immediate mitigation is required. Organizations using code-projects Assessment Management 1.0 must prioritize restricting network access to the affected administrative modules to prevent unauthorized exploitation while awaiting a vendor-supplied security update.