A critical SQL injection vulnerability in code-projects Exam Form Submission 1.0 exposes the system to remote, unauthenticated database manipulation.

The application is susceptible to SQL injection via the ID parameter in the /admin/delete_s2.php file, which allows an unauthenticated remote attacker to inject malicious SQL commands.

Successful exploitation of this vulnerability permits unauthorized interaction with the underlying database, which could lead to data exfiltration, modification, or deletion. With a CVSS score of 7.3, this represents a high-severity risk that could compromise the integrity and confidentiality of student or administrative information stored within the application.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin directory using IP-based allowlisting or robust authentication mechanisms.

Proactive Monitoring: Monitor server access logs for suspicious requests targeting the /admin/delete_s2.php file, particularly those containing SQL syntax characters in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the identified vulnerable endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue linked in the vulnerability research.

Given the public availability of exploit material and the lack of a vendor-supplied patch, this vulnerability poses a significant risk to any environment hosting this software. Administrators must prioritize isolating the affected component from external exposure immediately to prevent potential unauthorized access.