A critical SQL injection vulnerability in code-projects Exam Form Submission 1.0 exposes the application to remote, unauthenticated data manipulation.

This flaw is a SQL injection (CWE-89) located in the /admin/delete_s8.php file. It allows an unauthenticated, remote attacker to inject malicious SQL commands via the ID parameter, potentially bypassing intended security controls.

The ability for an unauthenticated attacker to inject arbitrary SQL queries poses a significant risk to data integrity and confidentiality. With a CVSS score of 7.3, this high-severity vulnerability could lead to unauthorized database access, modification of administrative records, or potential information disclosure, resulting in serious operational disruption and loss of trust.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin directory or disable the affected functionality entirely until a vendor update is released.

Proactive Monitoring: Monitor server access logs for unusual HTTP requests targeting the /admin/delete_s8.php endpoint, specifically looking for characters indicative of SQL injection such as single quotes, semicolons, or SQL keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in URL parameters to mitigate the risk of exploitation.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability record.

Given the availability of a public proof-of-concept and the lack of a vendor patch, this vulnerability presents an immediate risk to any deployment of Exam Form Submission 1.0. Security teams must prioritize isolating the affected component from public-facing networks and implementing strict input validation or WAF-based filtering to prevent unauthorized database interaction. Monitor vendor channels closely for the release of a security update.