An unauthenticated SQL injection vulnerability in code-projects Online Reviewer System 1.0 poses a significant risk of unauthorized database manipulation and information disclosure.

The vulnerability is a SQL injection flaw (CWE-89) located in the file /system/system/admins/assessments/pretest/exam-delete.php. An unauthenticated remote attacker can trigger this flaw by manipulating the test_id parameter to execute arbitrary SQL commands against the backend database.

The exploitation of this SQL injection vulnerability could lead to unauthorized data access, modification, or deletion within the database, potentially compromising the integrity and confidentiality of the Online Reviewer System. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent unauthorized administrative actions or data breaches that could disrupt business operations.

Immediate Action: Since a vendor-supplied patch is currently unknown, administrators should restrict access to the affected directory /system/system/admins/assessments/pretest/ via network-level controls until a fix is provided.

Proactive Monitoring: Monitor web server access logs for anomalous requests containing SQL syntax patterns or unexpected characters targeting the exam-delete.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule designed to detect and block SQL injection attempts targeting the test_id parameter.

Public Exploit Available: Yes — a published proof-of-concept exists via the technical disclosure at https://github.com/tiancesec/CVE/issues/18.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a credible risk to the integrity of the application. Organizations should prioritize isolating the affected component and implementing robust input validation or WAF rules to mitigate the threat until an official security update is released by the vendor.