The Exam Form Submission application is vulnerable to remote SQL injection, which could allow an unauthenticated attacker to compromise backend database integrity.

This vulnerability is a SQL injection (CWE-89) flaw located in the phone argument of the /user/dashboard.php file. The vulnerability is exploitable by unauthenticated remote attackers.

The exploitation of this vulnerability can lead to unauthorized data access, modification, or deletion within the underlying database. Given the CVSS score of 7.3, this represents a high risk to data confidentiality and integrity, potentially resulting in significant reputational damage or regulatory non-compliance if sensitive user information is stored in the affected database.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /user/dashboard.php endpoint or disable the affected module entirely if it is not business critical.

Proactive Monitoring: Review web server access logs for suspicious patterns in the phone parameter, specifically looking for SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to filter and block malicious SQL injection payloads targeting the phone parameter in incoming HTTP requests.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub repository referenced by the vulnerability disclosure.

Due to the availability of public proof-of-concept code and the lack of a vendor-supplied patch, this vulnerability presents a credible risk to the organization. IT teams should prioritize isolating the vulnerable component from public access and monitor for any signs of unauthorized interaction with the database until a permanent fix is provided by the vendor.