A flaw in the head.php component of code-projects Online Examination allows payloads supplied through the uname and password query parameters to be concatenated directly into a SQL statement. This lack of input sanitization creates a classic SQL injection vulnerability, identified as CWE-74 and CWE-89. If an attacker can supply the vulnerable inputs, they may read or modify database contents, potentially compromising the integrity and confidentiality of the application; it is uncertain if the attack can be carried out by unauthenticated users.

The affected product is code-projects Online Examination version 1.0. No vendor-provided patch or version update that resolves the vulnerability is listed in the supplied data. Administrators should consult the upstream repository or contact the project maintainers for an update that addresses the injection issue.

The CVSS score of 6.9 indicates a moderate severity is exploitable remotely via standard HTTP requests that include the uname and password parameters, though the need for prior authentication is not specified. An EPSS score of less than 1% suggests a low but non-zero probability of real-world exploitation. The issue is not currently listed in the CISA KEV catalog. An attacker would obtain the injection vector by targeting head.php with specially crafted query parameters, leveraging the unsanitized string concatenation to alter the SQL query.