A critical SQL injection vulnerability in the code-projects Online Event Judging System allows unauthenticated remote attackers to compromise the underlying database.

This is a SQL injection (CWE-89) vulnerability located in the create_account.php script. An unauthenticated attacker can inject malicious SQL commands via the fname parameter during the registration process, which is processed without sufficient sanitization.

Successful exploitation allows an unauthorized party to execute arbitrary SQL queries, potentially leading to full database compromise, sensitive data exfiltration, or data tampering. Given the CVSS score of 7.3, this vulnerability represents a significant risk to the integrity and confidentiality of the system, which could lead to unauthorized access to user accounts and system-wide service disruption.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the registration endpoint or disable the registration feature entirely until the vendor releases a secure version.

Proactive Monitoring: Monitor web server logs for suspicious POST requests to create_account.php, specifically looking for payloads containing SQL keywords like UNION, SELECT, or SLEEP.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the fname input parameter.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the security researcher's write-up on GitHub.

The severity of this vulnerability, combined with the availability of public proof-of-concept code, necessitates immediate defensive action. Administrators must implement the suggested compensating controls immediately, as the lack of a vendor patch leaves the system vulnerable to automated exploitation attempts. Users should prioritize monitoring for anomalous database behavior until a permanent fix is provided by the vendor.