The code-projects Exam Form Submission 1.0 application contains a critical SQL injection vulnerability that permits unauthenticated remote attackers to compromise database integrity.

This vulnerability is a SQL injection flaw (CWE-89) located within the /admin/delete_s1.php file. An unauthenticated attacker can exploit this by injecting malicious SQL commands into the ID argument to interact directly with the backend database.

The ability to perform unauthenticated SQL injection poses a significant risk to data confidentiality and integrity, as attackers may extract, modify, or delete sensitive information stored within the application database. Given the CVSS score of 7.3, this flaw is categorized as high severity due to the low complexity of the attack and the lack of required authentication. Failure to address this vulnerability could lead to total compromise of the application data layer.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /admin/ directory and evaluate if the application can be safely disabled until a fix is provided by the vendor.

Proactive Monitoring: Security teams should monitor web server logs for suspicious URL parameters containing SQL syntax or unusual activity targeting the /admin/delete_s1.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns specifically targeting this file path.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability disclosure.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents an immediate risk to any environment hosting this software. Organizations should prioritize isolating the affected component and implementing strict access controls immediately, as the current lack of a vendor-supplied patch necessitates proactive manual mitigation to prevent unauthorized database access.