The itsourcecode E-Logbook with Health Monitoring System for COVID-19 is vulnerable to remote SQL injection, which allows unauthenticated attackers to compromise database integrity.

This vulnerability is a SQL injection (CWE-89) located in the check_profile.php file, where the profile_id parameter fails to properly sanitize user-supplied input. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands against the backend database.

The ability for an unauthenticated attacker to inject SQL queries presents a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive health records, potential data exfiltration, or modification of application data, which may result in significant reputational and compliance issues. The CVSS score of 7.3 reflects a high severity, particularly due to the lack of required authentication.

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict access to the check_profile.php file or take the application offline until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual characters within the profile_id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection patterns targeting the identified vulnerable endpoint.

Public Exploit Available: Yes — a published proof-of-concept exists in the researcher's write-up at the provided GitHub repository reference.

This vulnerability represents a significant security risk given the ease of exploitation and the potential for unauthorized database manipulation. Organizations utilizing this software must implement strict access controls and monitor for malicious traffic immediately, as the public availability of a proof-of-concept significantly lowers the barrier for attackers to weaponize this flaw.