An unauthenticated remote SQL injection vulnerability in code-projects Online Reviewer System version 1.0 poses a significant risk of unauthorized database interaction and data exposure.

This flaw is a SQL injection vulnerability (CWE-89) located in the /system/system/admins/assessments/pretest/questions-view.php file. The application fails to properly sanitize the ID parameter, allowing an unauthenticated remote attacker to inject malicious SQL queries.

The vulnerability carries a CVSS score of 7.3, indicating a high-severity risk. Successful exploitation could lead to unauthorized access to sensitive application data, potential modification of database records, or the loss of data integrity within the assessment system. Given the nature of SQL injection, this could also serve as a vector for further system compromise or administrative account takeover.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected directory or implement strict input validation rules at the web application firewall level to block malicious SQL patterns in the ID parameter.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting the questions-view.php file, specifically looking for characters commonly used in SQL injection attacks such as single quotes, semicolons, and comment sequences.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection attempts. Additionally, ensure the database user account associated with the web application follows the principle of least privilege to minimize potential damage.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the GitHub issue reported by tiancesec.

Given the availability of a public proof-of-concept and the ease of exploitation over a network, this vulnerability presents a credible threat to organizational security. Security teams should prioritize isolating the affected component until a vendor patch is released or the code is manually remediated to include parameterized queries.