An unauthenticated remote SQL injection vulnerability in code-projects Exam Form Submission 1.0 poses a significant risk to data integrity and system security.

The application is susceptible to SQL injection via the ID parameter in the /admin/delete_s3.php file. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands, potentially leading to unauthorized database interaction.

The vulnerability carries a CVSS score of 7.3, reflecting the high potential for unauthorized database access or manipulation. Successful exploitation could lead to the exposure of sensitive student or examination data, compromise of administrative credentials, and unauthorized modification of system records, which may result in severe operational disruption and reputational damage.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /admin/ directory using network-level controls or web server authentication. Disable the affected Exam Form Submission component until a secure update is released by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting the /admin/delete_s3.php endpoint, particularly those containing SQL syntax or unusual query parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns to mitigate the risk of exploitation.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the provided GitHub repository reference.

Given the availability of a public proof-of-concept and the critical nature of SQL injection flaws, this vulnerability requires immediate attention. Security teams must prioritize isolating the vulnerable application and implementing compensating controls to prevent unauthorized database access while awaiting a formal vendor patch.