This vulnerability in code-projects Online Examination 1.0 allows remote attackers to perform SQL injection through the manipulation of multiple parameters in the /update.php?q=addquiz component of the Quiz Creation Feature. The injection flaw arises from improper input validation or sanitization of the parameters name, total, right, wrong, time, tag, and desc. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. There is no vendor advisory or patch available at this time, and the exploit code is publicly available, though no known exploitation in the wild has been reported.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. The impact is limited by the medium severity score and the low complexity of the attack vector. However, the exact extent of impact depends on the database privileges of the application and the environment configuration.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. In the meantime, restricting access to the vulnerable endpoint, applying web application firewall (WAF) rules to detect and block SQL injection attempts, and validating or sanitizing input parameters at the application level are recommended as temporary mitigations.