A critical SQL injection vulnerability in code-projects Exam Form Submission 1.0 exposes the application to remote exploitation.

The application is susceptible to SQL injection via the credits parameter in the /admin/update_s3.php file. This vulnerability is remotely exploitable by unauthenticated attackers.

Successful exploitation of this SQL injection flaw could allow an attacker to read, modify, or delete sensitive data within the backend database. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially leading to unauthorized administrative access or the compromise of student and examination records.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin/ directory and the update_s3.php file to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual parameters directed toward the /admin/update_s3.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch until the vendor releases a secure version.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up at the referenced GitHub repository.

This vulnerability presents a clear and present danger to the integrity of the Exam Form Submission platform. Due to the lack of an official vendor patch, immediate defensive measures such as network-level access controls and WAF implementation are required to protect the application from exploitation.