An unauthenticated SQL injection vulnerability in code-projects Exam Form Submission 1.0 poses a significant risk of unauthorized database manipulation.

This vulnerability is an SQL injection flaw (CWE-89) located in the /admin/update_fst.php file. It allows an unauthenticated remote attacker to manipulate the credits argument to execute arbitrary SQL commands.

Successful exploitation of this vulnerability could lead to unauthorized access to the application database, potential data exfiltration, or modification of sensitive information. Given the CVSS score of 7.3, this represents a high-severity risk that could compromise the integrity and confidentiality of the entire system.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory and evaluate if the application is necessary for current operations.

Proactive Monitoring: Review web server access logs for anomalous patterns, such as SQL syntax characters (e.g., single quotes or comment markers) appearing within the credits parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns targeting the /admin/update_fst.php endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced by the CVE record.

The presence of a public proof-of-concept combined with the ease of exploitation makes this a high-priority concern for any organization running this software. Organizations should immediately isolate the affected component from public-facing networks until a vendor-supplied security update is released and applied.