A remote, unauthenticated SQL injection vulnerability in code-projects Exam Form Submission 1.0 poses a significant risk of unauthorized database interaction.

This is a SQL injection vulnerability (CWE-89) triggered by improper sanitization of the credits argument within the /admin/update_s2.php script. The vulnerability is remotely exploitable by an unauthenticated attacker.

Successful exploitation allows an attacker to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion within the underlying database. With a CVSS score of 7.3, this high-severity flaw represents a notable risk to the confidentiality and integrity of application data, which could lead to significant operational disruption.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/ directory or disable the affected functionality until a vendor update is released.

Proactive Monitoring: Monitor server access logs for suspicious HTTP requests targeting the /admin/update_s2.php endpoint, particularly those containing SQL syntax characters in the credits parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule specifically configured to block malicious SQL injection payloads directed at the vulnerable script.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up on GitHub.

Given the availability of a public proof-of-concept and the lack of an official patch, this vulnerability requires immediate attention. Organizations should prioritize isolating the affected component from the public internet and implementing strict access controls or WAF filtering to prevent potential exploitation until a formal security update is provided by the vendor.