An unauthenticated SQL injection vulnerability in the Swatadru Exam-Seating-Arrangement application allows remote attackers to bypass authentication and compromise sensitive database content.

The application fails to sanitize user input in the email parameter of the student.php login form, leading to a SQL injection flaw. This vulnerability allows an unauthenticated remote attacker to manipulate SQL queries to bypass authentication or extract data.

Successful exploitation of this vulnerability permits unauthorized access to sensitive student and exam records, potentially leading to a complete breach of confidentiality and integrity for the application database. Given the CVSS score of 7.3, this represents a significant risk to organizational data privacy and administrative control over the exam system. The ability to execute arbitrary SQL commands may also lead to full server compromise depending on the database configuration.

Immediate Action: As no official patch is currently available from the vendor, administrators should restrict access to the student.php endpoint using network-level controls or a Web Application Firewall until the code is updated.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected SQL syntax or high volumes of requests to the login endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP POST requests targeting the student login form.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the technical write-up provided by the researcher on GitHub.

The presence of a functional proof-of-concept makes this vulnerability a credible threat to any deployment of the Exam-Seating-Arrangement software. Because the vendor has not provided a security update, security teams must prioritize implementing compensating controls, such as WAF rules or network segmentation, to protect the vulnerable student.php endpoint immediately.