A critical SQL injection vulnerability exists in code-projects Exam Form Submission 1.0 that enables remote, unauthenticated attackers to potentially compromise database integrity.

This is a SQL injection vulnerability (CWE-89) located in the /admin/update_s8.php file. Attackers can reach this endpoint remotely without authentication to manipulate the credits parameter and inject malicious SQL commands.

The vulnerability carries a CVSS score of 7.3, representing a high risk to the confidentiality, integrity, and availability of the underlying database. Successful exploitation allows an attacker to interact with the database, potentially leading to unauthorized data exfiltration, modification of records, or administrative bypasses that could disrupt business operations or compromise sensitive user information.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /admin/update_s8.php file or disable the affected component entirely if it is not business critical.

Proactive Monitoring: Review web server access logs for anomalous requests directed at /admin/update_s8.php, specifically looking for SQL syntax patterns or unexpected character strings within the credits parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeted at administrative endpoints.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the GitHub issue referenced in the CVE record.

Given the availability of a public proof-of-concept and the ease of remote access, this vulnerability presents a significant security risk. Administrators must prioritize isolating the affected application from public networks until an official security update is released by the vendor. Immediate implementation of WAF rules and access controls is essential to prevent potential exploitation.