An unauthenticated SQL injection vulnerability in code-projects Exam Form Submission 1.0 poses a significant risk of unauthorized database manipulation.

This is a SQL injection vulnerability (CWE-89) located in the /admin/update_s7.php file. The application fails to properly sanitize the credits parameter, allowing an unauthenticated remote attacker to inject malicious SQL commands.

The ability to perform unauthenticated SQL injection can lead to unauthorized access to, or modification of, sensitive database information. With a CVSS score of 7.3, this high severity flaw could result in complete compromise of the application data, potentially leading to significant reputational damage and loss of system integrity.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/update_s7.php endpoint or disable the affected module entirely until a secure version is released.

Proactive Monitoring: Review web server access logs for suspicious patterns involving the /admin/update_s7.php file, specifically looking for unusual characters or SQL keywords in the credits parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection filtering rules to block malicious payloads targeting this specific endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the linked GitHub issue.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a clear and present danger to affected environments. Organizations must prioritize restricting access to the vulnerable endpoint immediately and actively monitor for unauthorized requests while awaiting a formal vendor patch.