Code-Projects Question Paper Generator SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Code-Projects Question Paper Generator versions through 1.0. The issue arises in the file selectquestionuser.php, where the subid parameter is manipulated, allowing for the injection of arbitrary SQL commands. This vulnerability can be exploited remotely, and a proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability allows for arbitrary SQL code execution, which could lead to unauthorized data access or manipulation.

Reproduction

To reproduce this vulnerability, send a POST request to /exam/selectquestionuser.php with a crafted subid parameter that includes SQL injection payloads, such as UNION SELECT statements. The injected SQL will be executed by the database, demonstrating the SQL injection flaw.