A critical SQL injection vulnerability in code-projects Exam Form Submission 1.0 poses a high risk of unauthorized database manipulation by remote, unauthenticated attackers.

This flaw is a SQL injection vulnerability (CWE-89) located in the /admin/update_s4.php file. The application fails to properly sanitize the credits argument, allowing an unauthenticated attacker to execute arbitrary SQL commands remotely.

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk that could lead to unauthorized data exposure, modification, or potential loss of integrity within the application database. Because the attack vector is network-based and requires no authentication, the potential for widespread automated exploitation is significant, threatening both user data privacy and the operational stability of the affected service.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/update_s4.php file via network-level controls or disable the vulnerable component entirely if not in use.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests targeting the /admin/update_s4.php file, particularly those containing SQL syntax characters such as single quotes or comment markers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns directed at the vulnerable endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the CVE record.

Given the availability of public exploit material and the lack of an official vendor patch, this vulnerability presents a clear and present danger to affected environments. Organizations must prioritize immediate isolation of the vulnerable endpoint to prevent unauthorized database access. Continued vigilance is required until the vendor releases a security update that addresses the underlying input validation failure.