A critical SQL injection vulnerability in code-projects Exam Form Submission 1.0 exposes the application to remote data manipulation and potential unauthorized database access.

The application is susceptible to SQL injection via the USN parameter in the register.php file. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS attack vector.

Successful exploitation of this vulnerability allows an attacker to manipulate backend database queries, potentially leading to unauthorized data disclosure or modification. With a CVSS score of 7.3, this flaw presents a significant risk to the integrity and confidentiality of the application data, which could lead to service disruption or the compromise of sensitive user information.

Immediate Action: As no official patch is currently available, administrators should restrict access to the register.php file or disable the affected form functionality until a secure update is provided by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns targeting the register.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts directed at the USN parameter.

Public Exploit Available: Yes, a published proof-of-concept exists via the linked GitHub issue.

Given the availability of a public proof-of-concept and the remote, unauthenticated nature of this vulnerability, organizations must treat this as a priority issue. If the software cannot be patched or updated, it should be isolated from public-facing networks immediately to prevent exploitation of the database.