A critical SQL injection vulnerability in 1000projects Online Project Report Submission and Evaluation System allows unauthenticated remote attackers to compromise database integrity.

This vulnerability is a SQL injection (CWE-89) located in the /admin/controller/delete_group_student.php file. An unauthenticated remote attacker can inject malicious SQL commands via the batch_id parameter to interact with the backend database.

Successful exploitation of this flaw allows attackers to bypass security controls and potentially extract, modify, or delete sensitive data stored within the application database. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially leading to unauthorized access to student project reports and evaluation records.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin/ directory using network-level controls or authentication proxies.

Proactive Monitoring: Monitor web server access logs for anomalous requests containing SQL syntax patterns or unexpected input in the batch_id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting administrative endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the researcher at https://github.com/yunhdeng/CVE/issues/1.

The presence of a publicly available proof-of-concept significantly lowers the barrier for exploitation by malicious actors. Organizations currently running this software must prioritize restricting external access to the administrative controller and monitor for suspicious activity until a formal vendor patch is released.