A critical SQL injection vulnerability in the code-projects Online Application System for Admission 1.0 allows for unauthenticated remote exploitation, posing a significant risk to database integrity.

This vulnerability is an SQL injection (CWE-89) flaw located within the enrollment/index.php file. An unauthenticated remote attacker can inject malicious SQL commands into the login endpoint to manipulate backend database operations.

The ability to perform unauthorized SQL queries can lead to the exposure of sensitive student or applicant data, unauthorized modification of records, or potential bypass of authentication mechanisms. Given the CVSS score of 7.3, this high-severity vulnerability could result in severe reputational damage and the compromise of institutional data systems if left unaddressed.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected login endpoint or disable the vulnerable module until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous request patterns or strings commonly associated with SQL injection attempts, such as the use of single quotes or SQL syntax keywords in input fields.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection signatures targeting the enrollment/index.php endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced technical write-up from VulDB.

The presence of a public proof-of-concept significantly increases the risk of exploitation for this software. Organizations currently using version 1.0 of the Online Application System for Admission must prioritize the implementation of compensating controls, such as WAF filtering, while actively monitoring for official vendor guidance or patches to remediate this flaw permanently.