A critical SQL injection vulnerability in code-projects Exam Form Submission 1.0 allows remote, unauthenticated attackers to compromise database integrity.

This is a SQL injection vulnerability (CWE-89) located in the /admin/update_s5.php file. The vulnerability is exploitable remotely by an unauthenticated attacker through the manipulation of the credits parameter.

Successful exploitation of this flaw allows an attacker to execute arbitrary SQL commands against the underlying database. This can result in unauthorized data exposure, modification of application records, or potential administrative account compromise, which poses a significant risk to the confidentiality and integrity of the system. The CVSS score of 7.3 reflects the high potential for impact despite the limited scope of the affected component.

Immediate Action: Since an official patch is currently unavailable, administrators should immediately restrict external access to the /admin/ directory using IP allowlisting or VPN requirements.

Proactive Monitoring: Review web server access logs for anomalous requests directed at /admin/update_s5.php, particularly those containing SQL syntax or unusual characters in the credits parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block SQL injection patterns targeting the identified vulnerable endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents an immediate risk to environments hosting the Exam Form Submission software. Administrators must prioritize restricting network access to the administrative interface until a vendor-supplied security update is released and applied to the environment.