A critical SQL injection vulnerability in code-projects Exam Form Submission 1.0 allows for remote, unauthenticated database manipulation, posing a significant risk to data integrity.

This vulnerability consists of a SQL injection flaw located in the /admin/update_s1.php script, specifically within the credits parameter. The flaw is remotely exploitable without requiring authentication, allowing an attacker to inject malicious SQL queries directly into the backend database.

The ability to perform unauthorized SQL injection attacks against an administrative endpoint can lead to the full disclosure, modification, or deletion of sensitive exam data. Given the CVSS score of 7.3, this vulnerability represents a high risk that could compromise the confidentiality and integrity of the entire application database.

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict access to the /admin/ directory using IP allowlisting or VPN requirements.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting /admin/update_s1.php, specifically looking for characters indicative of SQL injection such as single quotes, semicolons, or SQL keywords in the credits parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection patterns to mitigate the risk of exploitation until a formal update is released.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the security researcher's write-up at the referenced GitHub repository.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability presents an urgent security risk. Organizations utilizing this software must prioritize isolating the affected component from the public internet to prevent unauthorized database access until the vendor provides a secure update.