A critical SQL injection vulnerability in code-projects Exam Form Submission 1.0 exposes the application to remote data manipulation by unauthenticated attackers.

This is a SQL injection vulnerability located within the /admin/delete_s5.php file. An unauthenticated attacker can exploit this by manipulating the ID argument to execute arbitrary SQL commands against the backend database.

Successful exploitation allows an attacker to compromise the integrity of the database, potentially leading to unauthorized data access, modification, or deletion. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to the confidentiality and availability of stored exam data, which could result in severe reputational damage and loss of administrative control over the application.

Immediate Action: Since an official patch is currently unknown, administrators should restrict network access to the /admin/ directory and the affected file to trusted IP addresses only. If the functionality is not business-critical, disable or remove the vulnerable file entirely until a vendor patch is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns targeting the /admin/delete_s5.php endpoint. Monitor database query logs for unusual execution times or unauthorized command structures.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts. Ensure input validation is strictly enforced at the application level for all parameters passed to administrative endpoints.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the CVE record.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses an immediate risk to systems running code-projects Exam Form Submission 1.0. Organizations should treat this as a high-priority item and implement the suggested compensating controls immediately to prevent potential unauthorized database access while awaiting further guidance or a security patch from the vendor.