An unauthenticated SQL injection vulnerability in code-projects Online Examination 1.0 poses a critical risk of unauthorized database access and data compromise.

This is a SQL injection vulnerability (CWE-89) located in the 'head.php' file. Unauthenticated remote attackers can manipulate the 'uname' and 'password' parameters to execute arbitrary SQL commands, potentially exposing user accounts, examination data, and system configurations.

Successful exploitation of this vulnerability could lead to a complete compromise of the application's backend database. Given the CVSS score of 7.3, this represents a high-severity risk that could result in unauthorized data exfiltration, loss of academic integrity, or system-wide disruption. The availability of public exploit code lowers the barrier for attackers to gain unauthorized access to sensitive institutional information.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the application and implement input validation routines to sanitize the 'uname' and 'password' parameters.

Proactive Monitoring: Review web server access logs for anomalous request patterns, specifically looking for SQL syntax characters (e.g., ', --, UNION) within the 'head.php' request parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting authentication parameters.

Public Exploit Available: True

Organizations utilizing this software must treat this as a high-priority issue due to the confirmed public exploit availability. Until a vendor-supplied patch is released, ensure that the application is isolated from public internet access where possible and that WAF rules are strictly enforced to mitigate potential SQL injection attempts.