A critical SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 exposes the application to remote, unauthenticated database manipulation.

This vulnerability is a SQL injection (CWE-89) triggered via the viewid parameter in the /admin/view-enquiry.php file. The flaw allows an unauthenticated remote attacker to inject malicious SQL commands into the backend database.

The ability for an unauthenticated user to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive parlor data, including customer inquiries and administrative information. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent potential data breaches or unauthorized system control.

Immediate Action: Since no official patch is currently available from the vendor, administrators should restrict access to the /admin/ directory using IP allowlisting or VPN authentication.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected characters directed at the view-enquiry.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming requests containing SQL injection payloads targeting the viewid parameter.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced in the GitHub issue tracker.

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability presents a credible risk to all installations of PHPGurukul Beauty Parlour Management System 1.1. Organizations must implement strict network-level access controls to the administrative interface immediately to mitigate the risk of unauthorized database access until the vendor releases a secure version.