This vulnerability in code-projects Assessment Management 1.0 arises from improper handling of the squestions[] parameter in the /lecturer/marking-scheme.php file, allowing an attacker to perform SQL injection attacks. The flaw enables remote attackers with low privileges to execute unauthorized database queries, potentially compromising data confidentiality and integrity. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no user interaction, and limited scope and impact on confidentiality, integrity, and availability. No vendor-provided fix or mitigation is currently documented.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited to the affected component and requires low privileges, but no further details on data exposure or system compromise are provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the vulnerable endpoint, apply web application firewall rules to detect and block SQL injection attempts targeting the squestions[] parameter, and review application input validation and sanitization practices.