This vulnerability in code-projects Assessment Management 1.0 involves improper sanitization or validation of the squestions[] parameter in the /lecturer/marking-scheme.php component responsible for database query handling. An attacker can remotely exploit this flaw to perform SQL injection attacks, potentially manipulating or accessing the underlying database. The CVSS 4.0 base score is 5.3, indicating a medium impact with network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impacts. No official fix or patch has been disclosed as of the published date.

Successful exploitation allows an attacker to inject SQL commands via the squestions[] parameter, which may lead to unauthorized data access or modification within the database. The impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. There is no indication of privilege escalation or complete system compromise from the provided data.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is released, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the squestions[] parameter. Avoid exposing the vulnerable component unnecessarily and restrict access to trusted users where possible.