The Exam Form Submission application is vulnerable to remote SQL injection, which could allow an unauthenticated attacker to manipulate backend database queries.

This vulnerability is a SQL injection (CWE-89) flaw located within the /admin/delete_s6.php script. An unauthenticated attacker can supply malicious input to the id parameter to interfere with database operations.

The ability to perform unauthorized SQL queries poses a significant risk to the integrity and confidentiality of the application database. Given the CVSS score of 7.3, this high-severity flaw could lead to unauthorized data exposure or modification, potentially impacting the reliability of exam submission records and administrative user data.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin directory or disable the vulnerable Exam Form Submission component until a fix is released.

Proactive Monitoring: Monitor web server access logs for anomalous requests directed at /admin/delete_s6.php, particularly those containing SQL syntax characters like single quotes or semicolons.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the identified endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided in the referenced GitHub issue.

Due to the public availability of proof-of-concept code and the ease of exploitation, this vulnerability requires immediate attention. Organizations utilizing the affected software should implement strict network-level access controls to the administrative interface and prioritize the transition to a more secure or updated alternative if the vendor fails to provide a patch.